ML090300249

01/22/09, Oconee Regulatory Conference, Unanticipated Reduction in Unit 1, RCS Inventory During Shutdown Conditions

ML090300249
Person / Time
Site:	Oconee
Issue date:	01/29/2009
From:	Duke Energy Corp
To:	NRC/RGN-II
Shared Package
ML090300220	List: ML090300225 ML090300240 ML090300249
References
Download: ML090300249 (37)

Text

Oconee Nuclear Station Regulatory Conference Unanticipated U ti i t d RReduction d ti in i Unit U it 1 RCS Inventory During Shutdown Conditions NRC Region II Office Atlanta, Georgia January 22, 2009 1

Duke Participants Dave Baxter Oconee Site Vice President Preston Gillespie Oconee Station Manager Eddie Anderson Oconee Operations Superintendent Rich Freudenberger g Oconee Safetyy Assurance Manager g

Steve Nader Duke PRA Engineering Supervisor Bryan Carroll Duke PRA Engineer Graham Davenport Oconee Regulatory Compliance Manager Dave Coyle Oconee Operations Support Manager Bob Meixell Oconee Regulatory Compliance Engineer Jeff Thomas Duke Regulatory Compliance Manager Enclosure 3 2

Agenda Opening Remarks Initial Plant Conditions Event Discussion PRA Discussion Root Causes and Corrective Actions Closing Remarks Enclosure 3 3

Opening Remarks The circumstances that led to the unplanned Loss of Inventory (LOI) did not meet Duke expectations 3/4 Inadequate Automatic Voltage Regulator (AVR) maintenance procedure IP/0/B/2005/001 resulted in main generator lockout and slow transfer of power 3/4 Failure to follow IP/0/A/3011/013A resulted in an over-current trip of the 1XP emergency feeder breaker due to an improperly set instantaneous magnetic trip device Duke agrees that the inadequate AVR maintenance procedure constituted a performance deficiency and a finding Enclosure 3 4

Opening Remarks Two root cause analyses were performed 3/4 Loss of backcharge source during AVR maintenance 3/4 1XP 600 volt AC system failed to re-energize as expected Prompt, thorough and comprehensive actions implemented An Event Investigation Team performed an independent review of causal analyses and action plans The LOI event has been factored into the Oconee Recovery Plan Enclosure 3 5

Opening Remarks During the event:

3/4 Reactor Coolant System (RCS) level never decreased to the reduced inventory level (3 feet below flange) 3/4 Event was quickly and correctly recognized and diagnosed 3/4 Operators quickly entered the appropriate procedures 3/4 RCS level was restored within 17 minutes 3/4 There was no core damage, no offsite release, and containment integrity was not compromised Processes would not have prevented the event from occurring during periods of higher risk; however, additional controls would be in place to help recognize and mitigate the event There are key differences between Dukes risk analysis and the risk analysis performed by the NRC Enclosure 3 6

Initial Plant Conditions Event Description Eddie Anderson, Oconee Operations Superintendent Enclosure 3 7

Initial Plant Conditions Day 4 of Unit 1 EOC24 Refueling Outage (April 15, 2008)

Reactor in Cold Shutdown (Mode 6), RV head detensioned but still in place, and the equipment hatch was closed RCS Conditions 3/4 RCS level 70 inches on LTLT-5 5 (84 inches is RV flange) 3/4 RCS temperature 96 F 3/4 Low Pressure Injection (LPI) Trains A and B in service 3/4 LPI in normal shutdown purification mode Enclosure 3 8

Initial Plant Conditions Additional sources of RCS makeup:

3/4 Borated Water Storage Tank (BWST; 360,000 gallons) 3/4 Bleed Holdup Tank (BHUT; 60,000 gallons)

Bleed Transfer Pump 1A available LPI Pump 1C available HPI Trains 1A and 1B available Electrical power supplied by backcharged main transformer Alternate power from switchyard available through startup transformer All emergency power sources available First-time performance of Automatic Voltage Regulator (AVR) Maintenance Procedure IP/0/B/2005/001 Enclosure 3 9

Event Discussion Interruption and restoration of control power to AVR actuated the K31 relay that caused Main Generator Lockout As designed, a slow transfer of auxiliary power to startup transformer restored Decay Heat Removal (DHR) in ~ 2 seconds MCC-1XP failed to re-energize as expected Certain Air Operated Valves on the purification loop failed closed due to loss of solenoid power from 1XP 3/4 Purification valves repositioning caused LPI Pump discharge pressure to lift purification relief valve Enclosure 3 10

Event Discussion Approximate Timeline 1323 - Unit 1 momentary interruption of power (~ 2 seconds) 1324 - Operators immediately check LPI status, review activated Statalarms, silence alarms, determine RV level decreasing from computer trend 1325 - AP/1/A/1700/026 (Loss of DHR) entered due to decreasing RCS level 1326 - Operators determine normal makeup lost and dispatch NEOs to open 1LP-21 (BWST Supply to LPI)

- Operator dispatched to close 1LP-96 (Purification Isolation) 1338 - RCS level at ~ 54.5 on LT-5 (lowest level observed)

- 1LP-21 throttled open 1340 - RCS Level at ~ 72 on LT-5 (level restored) 1344 - 1LP-21 closed. 1LP-96 closed to isolate purification to stop loss of RCS inventory. Approximately 2000 gallons of RCS transferred to MWHUT Enclosure 3 11

Event Discussion LOI event was promptly recognized by multiple operators from computer trends and mitigated. Level was restored within 17 minutes Operator stress levels did not impact event mitigation 3/4 DHR repowered automatically 3/4 Alarms silenced within minutes 3/4 Event and mitigation not complicated (only system in service was DHR)

Additional mitigating equipment available per Defense In Depth (DID) sheets and use was proceduralized 3/4 LPI Injection from BWST (2 trains/2 pumps) 3/4 HPI Injection from BWST (2 trains/2 pumps) 3/4 BWST inventory at 360,000 gallons Extensive oversight to assist control room operators Operators had > 180 minutes to recognize and mitigate the LOI prior to core damage Enclosure 3 12

PRA Discussion Steve Nader, Nader PRA Engineering Supervisor Enclosure 3 13

PRA Discussion The CCDP for this event is approximately 3.8E-07 The primary differences between Dukes risk analysis and the risk analysis performed by the NRC are

1. Treatment of 1XP failure

2. Timing g of the event

3. Credit for additional personnel

4. Dependency of human actions

5. Operator stress level Dependency Cut-off PRA Sensitivity Results Window of Vulnerability Enclosure 3 14

PRA Discussion

1. Treatment of 1XP failure 3/4 Failure of 1XP is an independent failure unrelated to the performance deficiency identified in the SDP 3/4 Instead of setting the event to 1.0 or TRUE, it should be based on the probability of an incorrect breaker setting 3/4 Per Duke Root Cause, this was a random failure of the technician to properly set the breaker 3/4 Inspections demonstrated that similar breakers were set properly 3/4 Interview with responsible technician supports the conclusion that this was an independent, random failure 3/4 Duke calculated failure rate is 3.0E-02 3/4 Considering this credit alone, revised CCDP would be 4.7E-07 Enclosure 3 15

PRA Discussion

2. Timing of the event 3/4 Refer to drawing and timeline 3/4 Time to midloop is significantly longer than assumed in the initial evaluations by Duke and NRC 3/4 Operators have 100 minutes instead of the assumed 70 minutes 3/4 This should be classified as expansive time, changing the multiplier by a factor of 10 (0.1 to 0.01) 3/4 Considering this credit alone, revised CCDP would be 4.9E-06 Enclosure 3 16

PRA Discussion Enclosure 3 17

PRA Discussion ONS LOI Event Timeline Operators Enter AP for LOI Operators Dispatched to Open LP 21 and Close LP 96 LP 21 Opened - Makeup Starts LP 96 Closed - Event Ends Midloop Event Draindown via Purification Relief Valve Heatup and Boiloff Core Damage Occurs 0 50 100 150 200 Time (minutes)

Enclosure 3 18

PRA Discussion

3. Credit for additional personnel 3/4 Shared Control Room - two complete crews and supporting shift personnel including OSM and STA 3/4 In excess of 15 people including management and author of EOP and AP 3/4 SDP evaluation is dominated by failure to recognize the LOI, yet no credit is given for these additional experts 3/4 Modest credit directly reduces the calculated significance of the event 3/4 Considering this credit alone, revised CCDP would be low E-06 to mid E-06 Enclosure 3 19

PRA Discussion

4. Dependency of Human Actions 3/4 Human errors and the evaluation of their interdependence drives the SDP conclusion 3/4 Subjective determination (contrary to the SDP goal to be objective) 3/4 Dominant cutset contains two human errors Failure to diagnose event (cognitive)

Failure to inject when level reaches midloop (cognitive/execution) 3/4 Dependency is more accurately evaluated by splitting the second action into its two parts (cognitive and execution) 3/4 Considering this credit alone, revised CCDP would be 5.7E-06 Enclosure 3 20

PRA Discussion

5. Operator stress level 3/4 A key input to determining the failure to diagnose the event 3/4 Power interruption was less than 2 seconds 3/4 Decreasing inventory was quickly and correctly recognized 3/4 Multiple p alarms silenced within minutes 3/4 Ample time available to diagnose and mitigate (100 minutes to midloop) 3/4 Nominal stress is more appropriate 3/4 Considering this credit alone, revised CCDP would be approximately 1E-05 Enclosure 3 21

Dependency Cut-Off Dependency Cut-off not used in actual SDP but can become important 3/4 SDP evaluation cites NUREG good practice which proposes a cap of 1E-05 3/4 If applied, findings analyzed via the Shutdown SDP (which is HRA driven) will be Yellow - not a useful insight 3/4 Previous Shutdown SDP findings have been characterized by the NRC as Green or White 3/4 Draft Low Power/Shutdown ANS Standard does not specify a limit - no industry consensus Enclosure 3 22

PRA Sensitivity Results Factor Discussion Revised CCDP Color for each issue Treatment of 1XP Failure of 1XP is a latent error independent of 4.7E-07 Green the performance deficiency Timing of Event > 100 minutes available to Mid-Loop vs. 70 4.9E-06 White minutes Additional Personnel Additional personnel independent of the Low E-06 to White operating crew were available Mid E-06 Diagnosis and Action Action component of HEP is not dependent on 5.7E-06 White Dependencies cognitive component Operator Stress Stress levels normal versus high ~1E-05 White - Yellow Enclosure 3 23

Window of Vulnerability Event significance is very dependent on when it occurred 3/4 Midloop operation -- Reduced time to core damage; SDP result may be an order of magnitude higher 3/4 Refueling canal flooded -- Increased time to core damage; SDP result mayy be an order of magnitude g lower 3/4 Unit in No Mode -- Event would not occur 3/4 Not in backcharge alignment -- Event would not occur Enclosure 3 24

PRA Overview/Conclusions SDP for Shutdown Events is very dependent on human error evaluation and stretches the capabilities of HRA Analysis Reasonable analysts can reach quantitative conclusions that differ by an order of magnitude Quantitative results should be balanced by qualitative factors 3/4 Multiple independent cues throughout the event 3/4 Additional sources of RCS makeup 3/4 All required equipment available 3/4 Adequate procedural guidance to mitigate the event 3/4 Ample time to respond 3/4 Additional personnel to respond to the event Dukes calculated CCDP for this event is approximately 3.8E-07 Enclosure 3 25

Root Causes and Corrective Actions Preston Gillespie, Gillespie Oconee Station Manager Enclosure 3 26

Root Causes and Corrective Actions Two separate root cause analyses were performed 3/4 Loss of backcharge source during AVR maintenance 3/4 1XP did not re-energize as expected Prompt, thorough and comprehensive actions implemented An independent Event Investigation Team was formed to 3/4 Validate/determine causes and contributing causes 3/4 Ensure appropriate corrective and enhancement actions The LOI event has been factored into the Oconee Recovery Plan Enclosure 3 27

Root Causes and Corrective Actions Root Cause (Loss of Backcharge Source) 3/4 Failure to recognize an unanticipated system interaction between the AVR trip circuitry and the backcharge power path.

During the development and review of procedure IP/0/B/2005/001, preparers and reviewers did not recognize that interruption and restoration of control power to the AVR would actuate the K31 relay. Thus, steps to isolate actuation of the K31 relay were not included Contributing Cause 3/4 Backcharging Procedure OP/1/A/1107/005 did not provide isolation from unnecessary trip signals Enclosure 3 28

Root Causes and Corrective Actions Actions Taken or Planned (Loss of Backcharge Source) 3/4 Comprehensive action plan includes dozens of action items 3/4 AVR maintenance procedure IP/0/B/2005/001 placed on hold and later revised to appropriately address backcharge path 3/4 Reviewed work activities planned during backcharging and rescheduled many to when unit auxiliaries are on the startup transformer 3/4 Reviewed outage-related first-use procedures for risk impact 3/4 OP/1,2,3/A/1107/005 revised to isolate unnecessary trips and ensure protected trains are adequate Enclosure 3 29

Root Causes and Corrective Actions Actions Taken or Planned (Loss of Backcharge Source) 3/4 AP-26 revised to enhance existing mitigation strategies 3/4 Upgraded simulator to model RCS conditions during outage 3/4 Performed LOI assessment Established administrative controls similar to reduced inventory controls prior to dropping RCS loops Blocked open AOVs in LPI purification loop Eliminated use of LPI purification when in reduced inventory 3/4 Plan to enhance Nuclear System Directives 403 and 703 3/4 Formally establish electrical work integration team Enclosure 3 30

Root Causes and Corrective Actions Root Cause (1XP did not re-energize as expected) 3/4 Failure to follow procedure. During the last breaker PM (1EOC23), the breaker technician failed to restore the breaker setting to the as-found HI instantaneous setting Contributing Causes 3/4 Procedure did not have a place keeper nor did it require concurrent verification for the breaker setting 3/4 Additional outage loads increased inrush on the breaker above the LO trip setpoint (not an issue with breaker set to HI)

Enclosure 3 31

Root Causes and Corrective Actions Actions Taken or Planned (1XP issue) 3/4 Comprehensive action plan includes numerous actions 3/4 1XP-F3A breaker magnetic trip setting returned to HI 3/4 IP/0/A/3011/013A revised to include concurrent verification for breaker setting (extent of condition review planned) 3/4 Reviewed loads off 1XP and scheduling of associated transfer of power procedures to minimize risk 3/4 Reviewed MCC breaker settings for 600 Volt molded case normal and emergency feeder breakers 3/4 Plan to perform breaker coordination study Enclosure 3 32

Closing Remarks Dave Baxter, Baxter Oconee Site Vice President Enclosure 3 33

Closing Remarks We understand and accept the finding The circumstances that led to the unplanned LOI did not meet Duke expectations Operators promptly recognized the LOI, quickly silenced alarms,, and entered the appropriate pp p procedures p

There was adequate mitigation capability Ample time was available to diagnose and mitigate the event Dukes calculated CCDP for the actual event is ~ 3.8E-07 Enclosure 3 34

Closing Remarks Processes would not have prevented the event from occurring during periods of higher risk; however, additional controls would be in place to help recognize and mitigate the event Two root cause analyses were performed Prompt, p , thorough g and comprehensive p actions implemented p

An independent Event Investigation Team was formed to validate causes and contributing causes and ensure appropriate corrective and enhancement actions Enclosure 3 35

Closing Remarks Duke clearly recognizes the vital safety function performed by DHR during shutdown conditions and the importance of pproper p outage g management g to reduce the likelihood and consequences of shutdown events Enclosure 3 36

Simplified LPI Purification Diagram Enclosure 3 37