ML082620687

Exelon'S Public Meeting Slides for Byron Regulatory Conference - 9/16/2008

ML082620687
Person / Time
Site:	Byron
Issue date:	09/16/2008
From:	Exelon Nuclear
To:	NRC/RGN-III
References
Download: ML082620687 (48)

Text

Byron Station Regulatory Conference Unit 2 Inadvertent Entry Into An Elevated Risk ConditionSeptember 16, 2008 2 AgendaIntroductionD. HootsFinding and Root Cause EvaluationB. AdamsOperations Actions S. FruinRisk Assessment G. KruegerConclusion B. Adams IntroductionDavid HootsSite Vice President 4 Introduction Provide information regarding the event, root cause evaluation and corrective actions taken Provide insights gained from risk significance determination process evaluation Provide information as to our ability to carry out mitigating actions in a timely manner Provide additional technical information requested by NRC August 14, 2008 letter Provide information indicating that credit for Operation actions is appropriate Finding and Root Cause EvaluationBrad Adams Plant Manager 6 Finding Potentially Greater Than Green Finding*Apparent violation of 10 CFR 50.65(a)(4)*Failure to perform an updated risk evaluation prior to surveillance testing of t he Unit 1 Train A Emergency Diesel Generator (EDG) based on existing plant conditions*Resulted in inadvertently entering an elevated risk condition on Unit 2 due to degraded internal flood mitigation capability 7Essential Service Water (SX)System Information Provides cooling water to safety related components Two trains per unit with mechanical draft cooling towers providing the ultimate heat sink Valves 1SX033 and 1SX034 are Unit 1 train cross-tie discharge isolation valves for the 1A and

1B SX trains Valves 1SX033 and 1SX034 are located on 330' elevation in the Auxiliary Building 8Event Background Replacement of 1SX034 scheduled during Unit 1 spring 2008 refueling outage Part of material condition improvement project to replace SX system butterfly valves Two clearance orders generated for electrical and mechanical isolation of 1SX033 During clearance order placement, valve 1SX033 was electrically closed to support work on 1SX034 9 Event Timeline March 28, 2008*Risk configuration assessment conducted to support work on 1SX034*Leak-by noted and an attempt to manually close 1SX033 to reduce leak-by performed*During manual oper ation of 1SX033, an abnormal noise heard from the valve act uator, which prompted the decision to conduct troubleshooting on the actuator 10 Event Timeline (cont.) April 1, 2008*Revision to the risk assessment performed to cover the 1SX033 troubleshooting and potential repair April 2, 2008 *1SX033 and 1SX034 were left in the closed position and electrically de-energized to support the troubleshooting on 1SX033 April 4, 2008 *The outage schedule contained a task to perform a clearance order to electrically open 1SX033 and manually open 1SX034 to support (1A EDG) testing*However, the scheduled task could not be executed as written because, both valves were maintained in the closed position, electrically de-energized and incapable of opening from the main control room 11 Event Timeline (cont.) April 5, 2008, at 02:19*Equipment Status Tags (ESTs) were hung on valves 1SX033 and 1SX034 April 5, 2008, at 03:04*To support EDG testing, both 1SX033 and 1SX034 valves were opened manually*This configuration change was not evaluated for Unit 2 on-line risk impact April 6, 2008*During Work Control Cycle Manager review of risk configurations for the next week, the configuration change was recognized as a potential risk impact and the Station Risk Engineer was consulted 12 Event Timeline (cont.) April 6, 2008*At 16:52, based on input from the Station Risk Engineer and Work Control Cycle Manager, Operations declared Unit 2 on-line risk to be Orange due to 1SX033 and 1SX034 being unable to clos e from the main control room*At 17:12, operator stationed at valve 1SX033 and Unit 2 on-line risk was evaluated as being Green (38 hours4.398148e-4 days <br />0.0106 hours <br />6.283069e-5 weeks <br />1.4459e-5 months <br />)*At 21:24, 1SX034 was manually closed (42.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />) 13 Root Cause Evaluation Root Cause*Less than adequate Operations ownership of on-line risk process when plant configuration changed Contributing Causes*Less than adequate training provided for work groups which led to a lack of know ledge of configuration risk management*Work Management procedural guidance associated with configuration risk management lacked specificity*Equipment difficulty asso ciated with emergent work on 1SX033 14 Root Cause Evaluation (cont.) Organizational and Programmatic Issues*Less than adequate site awareness of Auxiliary Building internal flooding wi th respect to processes and procedures*Limited management oversight of configuration risk management process 15Immediate Corrective Actions Performance management performed for personnel involved in event Increased awareness provided for risk management reviews *Formal Standing Order issued to the Operations Shift*Clear expectations for ownership communicated to all Operations Shift Managers by the Shift Operations Superintendent 16Interim Corrective Action toPrevent Recurrence (CAPR)Developed and implemented Byron-specific revisions to Exelon CAP and Online Work Control Process procedures to include expectations and clear guidance for Operations Shift Management roles and responsibilities regarding risk management*Specific guidance on the use of Paragon risk program*Specific guidance for review of the Risk Summary Sheet that WorkManagement generates*Specific guidance for communications*The change management process is being utilized to incorporate this interim action prior to the upcoming refueling outage 17Corrective ActionsCAPR -Revise the corporate procedures (CAP and Online Work Control Process) to include*Specific guidance on the use of Paragon risk program*Specific guidance for review of the Risk Summary Sheet that Work Management generates*Specific guidance for communications*Responsible -OperationsDue 11/19/08 18 Additional Corrective Actions Perform and document observations, including targeted observations during the refueling outage*Perform periodic roll-ups of the observations Used the Systematic Approach to Training (SAT) process to include enhanced training in the 1st

quarter, 2009 licensed operator requalification

training 19Summary Lessons Learned*Did not maintain proper Operations focus for evaluating risk when conditions changed Primarily focused on Technical Specifications applicability*Improvements needed in teamwork between site groups to assure focus includes evaluating risk*Going forward Performance management has been applied Procedures have been improved Training program is being strengthened Progress is being monitored Operator Actions Scott Fruin Shift Operations Superintendent 21Procedures/Training Prior to the event, an abnormal operating procedure existed (1/2 BOA PRI-7) that dealt with mitigation of SX system leakage Alarm response procedures existed for responding to Auxiliary Building sump alarms 22Procedures/Training Identification and isolation of components is a skill of the operatorsTraining was provided previously on flood mitigation in licensed operator requalification training*2008 -SX leak on supply to 0A VC Chiller*2007 -SX header break between 1SX004 and 1SX007*2005 -SX pump suction leak*2003 -SX header break between 1SX004 and 1SX007 Use of drawings to identify isolation points, for clearance and tagging, is a common task used routinely by Operations personnel 23Procedures/TrainingTwo new procedures were devel oped for flooding prior to the event to support a recent license amendment *Abnormal operating procedure (0BOA PRI-8) *Operating Procedure (BOP SX-22)*Procedures cover assessment of environmental conditionsMany licensed operators rece ived classroom training on new Byron specific oper ating and abnormal operating procedures during requalific ation training prior to the outage*14 of 28 Reactor Operators*23 of 36 Senior Reactor Operators*Both shifts had personnel that received the training prior the event 24Procedures/TrainingPost outage, a tabletop scenario was developed and administered to Operations personnel Six operators were evaluated and all were able to diagnose the source of the leak and identify actions to take within a short period of time (within an hour)*Personnel utilized various tools including their plant knowledge, training, draw ings and procedures to complete the scenario 25Procedures/Training Conclusions of the table tops -*Personnel were confident that they could get to, and isolate the necessary equipment within a short period of time (within an hour)*No special equipment is needed to perform the isolation beyond fire boots, gloves, flashlights, etc.*Confirmed there is high confidence that a leak can be diagnosed in a sufficiently short time to allow substantial time for mitiga tion prior to reaching critical flood volume for charging pump impact*No environmental issues were identified that would prevent successful mitigation of a leak 26 Additional Support The period of time the 1SX033 and 1SX034 were unable to be closed from the main control room occurred during a refueling outage *Additional Operations personnel were available, at all times, in the plant to i dentify and respond to a leak Outage period -14 SROs, 10 ROs, 21 EOs On-line period -5 SROs, 4 ROs, 8 EOs*Additional workers, who were in the plant, would aid in identifying the sour ce of the leak 80 work activities in Auxiliary Building at 383' elevation or below 27 Additional Support Additional resources*The Outage Control Center (OCC) was staffed for the outage, which would provid e immediate support to mitigate a potential leak*At least one of the three most knowledgeable engineers on the SX system were on site, at all times, during the eventSX System Engineer SX back up System Engineer SX experienced Design Engineer 28 Additional Support Uncontrolled flooding in the Auxiliary Building would require entry into an Unusual EventEscalation to an Alert would be declared if there was degraded safety system performance or industrial safety hazards that preclude monitoring of safety system performance An Alert declaration would result in the Technical Support Center being staffed and additional resources being available to mitigate a leak 29 Additional Information At least 1,300,000 (1.3 million) gallons of water would be needed to cause failure of the Chemical

& Volume Control (CV) System*The SX basin holds approxim ately 800,000 gallons of water*At least 500,000 gallons of water would have to be added to the SX basin to reac h the 1.3 mill ion gallons needed *Operators would need to c ontinue to make up to basin to reach the level in Auxili ary Building to impact the CV pumps 30Past Experience Previous Issue Reports*800016 -Steam Leak Actions*508273 -Steam Generator Tube Leak Actions*433581 -Significant Instrument Air Leak*663146 -Flooding the Mechanical Maintenance Office*494214 -Flooding in the Warehouse*351652 -Warehouse Number 3 Flooding

• 177851 -Loop Level Indication Spill*573193 -Plugged Floor DrainIndicates previous success in identifying and isolating component leakage 31Summary Previous and continuing training is provided to build and maintain Operators skills regarding the ability diagnose and mitigate leaks Procedures are adequate to support the identification and mitigation of leaks No special equipment is required to isolate leakage Any environmental conditions could have been mitigated based on our past experience 32Summary Additional support was available to the Operators to assist in identifying and mitigating a leakSufficient time was available for the Operators to implement the traini ng and procedures that were available Additional water (500,000 gallons) would need to be added to the basin to flood the CV pumps SDP Evaluation Greg KruegerExelon Corporate Risk Management 34 IMC 0609, Appendix KExelon Risk EvaluationExelon assessed the risk significance of the plant configuration using a Phase 3 evaluation*Employed PRA tools and insights that are more detailed than that m odeled in the (a)(4) risk model used to support MRulerequirementsIMC 0609, Appendix K is a Phase 1-2 screening tool Appendix K does not provide guidance for performing a Phase 3 evaluation Phase 3 guidance in IMC 0609, Appendix A, was used 35 IMC 0609, Appendix A Phase 3 Guidance Credit for recovery should be given only if the following criteria are satisfied*Sufficient time is available*Environmental conditions allow access, where needed*Procedures describing the appropriate operator action exist*Training is conducted on the existing procedures under similar conditions*Any equipment needed to per form these actions is available and ready to use 36 Operator Action It is reasonable to credit operator action for diagnosing and isolating the SX leakPlant-specific and scenario-specific factors clearly demonstrate a success path is feasible, per the requirements of the ASME PRA Standard and NUREG-1852, "Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire"*There is an extended period of time available for diagnosis and execution of the required actions *There are procedures in place that guide the operators to success, and training is provided*There is sufficient manpower available to assist with diagnosis and execution *There are sufficient cues and indications available for diagnosis 37 Industry Experience NUREG CR-4674, Volume 27, "Precursors to Severe Core Damage Accidents: 1998-A Status Report"*Columbia Station 1998 Fire Protection system rupture due to water hammer Rupture resulted in flooding in the reactor building Flooding noted by Shift Supervisor Source of flooding was isolated by control room by securing firepumps within 16 minutes Some equipment failures occurred that complicated response Water level in plant was mitigated by valve isolation and temporary pumps within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 38 Flooding Model Summary of Byron Auxiliary Building SX Flooding Scenarios in the Flooding Analysis 646-271296-646Time to CFV2 (1)(min)9.6E-0622612000-48000 SX7.6E-043988100-2000 SXFrequencyLength (ft)Size (gpm)Source(1) Time needed to reach the CV pumps 39 Flooding Model Isolation of Fire Protection (FP) or Non-essential Service Water (WS) leaks accomplished by turning off the pumps which terminates the driving

force for water entering the Auxiliary Building Isolation for SX leaks requires turning off pumps in the affected train and isolating that train from

the other operating SX train. This is the portion

modeled in the PRA 40 Phase 3 Evaluation Exelon determined that appropriate credit for operator action is warranted since each of the criteria specified in IMC 0609, Appendix A, have

been satisfied*Exelon's evaluation determine d that the frequency of a leak of greater than 2000 gpm would fall below the White threshold*Leakage between 100 and 20 00 gpm were further evaluated 41 Phase 3 EvaluationA total of 1.3 million gallons of water would be needed prior to affecting the CV pumps; the PRA treats loss of the CV pumps following any SX

flooding event as core damage For the range of leakages pertinent to the analysis, the leak would need to exist for the

following durations to cause an impact on the CV

pumps*For a 100 gpm leak -216 hours*For a 2000 gpm leak -10.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 42Phase 3 Conservatisms No reduction in leak flow credited when SX pumps failLeaks in SX pump rooms require more than 1.3 million gallons to reach CV pumps (additional volume not credited in timing analysis and ignores efficacy of SX room water tight doors)*SX piping in SX pump rooms is 30% of all SX piping in the Auxiliary Building Additional 500,000 gallons from make-up systems to SX basins would be required to reach critical flood volumes (this could be prevented by turning off the make-up pumps) 43 SDP ResultsTotal Using Byron HRA1.3E-07 2.7E-07Total Using SPAR-H 4.6E-08 1.0 42.3 9.6E-062000-48000 8.4E-08 2.3E-02 (Byron HRA) 42.3 7.6E-04100-2000 2.2E-07 6.0E-02 (SPAR-H)42.3 7.6E-04100-2000 SDP Result (CDP)Isolation Failure Probability Duration (hrs)Frequency (per/yr)SX flow rate (gpm) 44SDP Conclusions Risk significance of the event is below the Green/White threshold (i.e., low safety significance) given limited credit for operator response Credit for operator ac tion is warranted because:*Sufficient time is available to recognize and mitigate a significant number of potential flooding scenarios*Procedures were available and training was provided to help guide plant staff to isolate leakage paths*Sufficient manpower was available to support isolation of a flooding event*A spectrum of physical and equipment configurations were possible to mitigate an event Independent review has confirmed these results/assumptions ConclusionBrad Adams Plant Manager 46 Conclusion The event identified weakness in our knowledge and teamwork associated with the configuration risk program, we continue to:*Train our personnel*Improve our processes *Monitor our progress Operations personnel have the necessary training and skills to identify and respond to system

leakage 47 Conclusion (cont.) The tools needed to identify and respond to leaks (drawings, procedures) have been shown to be effective The Phase 3 SDP has shown that there is a substantial amount of time that a leak would need to exist prior to any potential for core damage 48 Conclusion (cont.) Additional personnel were available to help in identifying and responding to a potential leak Based on the information provided, it is appropriate to allow credit for operator actions, which results in the event being of low safety significance (i.e., Green)We recognize the importance of the event and have and continue to take appropriate corrective actions