05000250/LER-2001-001
| Docket Number | |
| Event date: | 06-08-2001 |
|---|---|
| Report date: | 08-01-2001 |
| 2502001001R00 - NRC Website | |
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 05000250
EVENT DESCRIPTION
On June 8, 2001, during the performance of the monthly Control Room Emergency Ventilation System Operability Test required by Technical Specification (TS) Surveillance Requirement 4.7.5 b, a flow switch did not automatically start an emergency supply fan as designed. When placed in emergency recirculation mode, the Control Room Emergency Ventilation System is designed to function with one emergency supply fan in operation providing 1000 +/- 100 cfm air flow through the cleanup filters.
Volume control dampers D-20 and D-21 [VI:cdmp] are adjusted to ensure flow through the filters and limit the amount of system makeup. If the primary emergency supply fan (SF-1B) [VI:fan] fails to start, flow switch FS-6659A [VI:fs] will automatically start a backup supply fan (SF-1A) [VI:fan] on detection of low flow. Operations declared the test unsatisfactory and entered the 84 hour9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> TS Action Statement 3.7.5 for inoperability of the Control Room Emergency Ventilation System on June 8, 2001, at 10:28 PM.
Troubleshooting indicated that the SF-IA fan was working properly, but was not getting a start signal from the flow switch. On June 9, 2001, FS-6659A was recalibrated. Flow measurements taken revealed that the margin between flow switch actuation and residual system flow was small and that flow past the flow switch sensor with both fans off was above the switch setpoint. The system engineer noted that the setting of the D-21 damper did not correspond to his recollection of its previous condition. Paint patterns on the damper positioner appeared to confirm the earlier position. The volume control damper, D-21, was adjusted to its original position which provided the required flow for actuation of the switch. The annual Control Room Emergency Ventilation Operability Test was performed to verify that the system was fully operable. The Control Room Emergency Ventilation System was declared in service on June 9, 2001, at 6:20 PM.
Subsequent review of design basis documentation established that the design basis of the emergency ventilation system (with respect to radiological emergencies) is to be capable of automatically starting under accident conditions to initiate control room pressurization and filtration, assuming the occurrence of a single active damper or supply fan failure. Starting in this context means that the required dampers actuate to establish the recirculation and emergency makeup flow paths and that a single supply fan starts and maintains flow within acceptance limits. NUREG-1022 characterizes the inability of a system to meet its single failure design basis as reportable under 10 CFR 50.72 (b)(3)(ii)(B). Although the SF-1B fan auto started and provided the required recirculation flow as designed, the as-found damper position would have prevented the SF-1A supply fan from automatically starting on low flow had there been an actual failure of the SF-1B supply fan. In that case, the Control Room Emergency Ventilation System would have been in a condition in which it was not capable of performing its design basis given a failure of the SF-1B supply fan. Consequently, on July 12, 2001, the as-found condition was reported to the NRC under 10 CFR 50.72 (b) (3) (ii) (B) as an unanalyzed condition that could significantly degrade plant safety.
ROOT CAUSE
The probable cause of the failure was determined to be the mispositioned damper D-21 due to inadequate administrative control of damper position. Testing confirmed that adjustment of D-21 to a more closed position restored system function. Additional system testing and analysis verified that other FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 05000250 I REVISION potential root causes, including those associated with instrument drift and offset, were not capable of producing the surveillance test failure observed. Testing also revealed that there was little margin between the normal "no fan" flow and the low flow actuation setpoint of FS-6659A.
The system engineer noted during troubleshooting that the setting of the D-21 damper did not correspond to his recollection of its previous condition. Paint patterns on the damper positioner also appeared to confirm the earlier position. It could not be determined when the damper was repositioned, but the system had last been tested satisfactorily on May 2, 2001. A search of the work order history for the system indicated that the only maintenance performed on the system since the May operability test was the monthly air conditioning Preventative Maintenance (PM) activities performed on May 10, and May 12, 2001. The only work performed inside the mechanical equipment room for the PM was to replace the air handler roughing filters. No work was performed on the D-21 balancing damper, cleanup filters, flow switches, motor-operated dampers, or supply fans. Interviews conducted with plant personnel indicated that the damper had not been repositioned during those maintenance activities. In addition, Operations reports that no adjustments were authorized to be performed on the balancing damper D-21. The system operating procedure only permits manual adjustment of this damper with Engineering assistance. The damper is pinned in place to preclude changes in position due to vibration and flow oscillations.
Administrative controls for positioning of the damper were inconsistent among system procedures and inadequate when compared to other throttled components in other systems that could be capable of impacting system function. A lack of administrative barriers to repositioning of D-21 is considered a significant contributor to this event.
BACKGROUND
The Control Room HVAC envelope consists of the Control Room and the Mechanical Equipment Room (located in the southwest corner of the Cable Spreading Room) including the Control Room's offices, rack area, kitchen, and lavatory. Both rooms are considered part of the envelope because both are serviced and pressurized by the control room's air handlers through common ductwork. The boundaries of the envelope are the floors, walls, ceilings, dampers, doors and ductwork of the two rooms.
During normal operation, fresh makeup air is admitted to this system through an intake louver and two dampers in series (D-1A and D-1B) located in the west wall of the Control Building. This system maintains a positive pressure in the Control Room envelope greater than that in the cable spreading room in order to prevent smoke from a potential fire in the cable spreading room from entering the Control Room. All Control Room penetrations, including doors, are designed for leak tightness standards. Two radiation monitors located in the air intake downstream of dampers D-1A and D-1B continuously monitor for radiation in the incoming air. In the unlikely event of a radiological accident, the Control Room ventilation system will automatically be placed in a recirculation mode. The normal outside air intake dampers D-1A and D-1B will close and emergency recirculation fan SF-1B will auto start. Outside air dampers D-2 and D-3 will open and recirculation dampers D-11A and D-11B will open. Kitchen and lavatory exhaust fans V-56 and V-28 will automatically turn off and their associated dampers will close.
DOCKET
The following signals will automatically activate the recirculation mode:
1. Control Room HVAC test switches (two) 2. High radiation from Control Room intake radiation monitors (6642 or 6643) 3. High containment radiation from R11 or R12 4. Automatic or manual initiation of safety injection 5. Manual containment isolation phase 'A' (1/2 pushbuttons) 6. Manual containment isolation phase 'B' (2/2 pushbuttons) When the Control Room ventilation system shifts into the recirculation mode due to one of the above signals, the air conditioning and handling units will remain running.
After shifting into the recirculation mode, the normally isolated cleanup filters are placed in service.
The charcoal filter unit includes both high efficiency particulate air (HEPA) and charcoal filters to prevent radioactive particulates from entering the Control Room atmosphere. Its capacity is 1000 cfm which is composed of 250 cfm of outside makeup air, and 750 cfm of recirculation air from the Control Room Air Handlers.
The Control Building emergency supply fans, SF-1B and SF-1A, are normally used in conjunction with the charcoal filter unit to remove radioactive particulate from the Control Room atmosphere. Upon an initiating signal, fan SF-1B will start. If the fan fails to start, a low flow signal is generated by FS- 6659A which starts the alternate fan. The Control Room operator is alerted to this condition by annunciator X-6/1 "CONTROL BLDG ELEV CAB TRBL/EMERG VENT LOW FLOW." In the event that both fans are running, and a high flow signal (1260 cfm) is generated by FS-6659B, the supply fan SF-1B will be stopped. Time delays permit damper operation and flow stability before the high or low flow logic is addressed.
The supply fans are used to recirculate air in the Control Building through the HEPA and charcoal filters and to draw a small portion of outside air into the Control Building, through the HEPA and charcoal filters. Since the Control Room is maintained at slightly more than atmospheric pressure, the infiltration of contaminated air into the Control Room is negligible. Dampers D-2 and D-3 provide a path for the outside air to the suction of the supply fans. Actual system flow is regulated by two volume control dampers (D-20 and D-21) located in the mechanical equipment room.
ANALYSIS OF SAFETY SIGNIFICANCE
The as-found position of damper D-21 did not significantly degrade plant safety. As demonstrated during the operability test, the SF-1B fan did successfully start and provide the required pressurization and filtration functions on demand. The system flow rate with one supply fan operating was demonstrated to be within design values.
In most cases, failure of the SF-1B supply fan would be indicated in the control room. Operator action E-0, "Reactor Trip or Safety Injection." Step 12 requires that the operators verify proper alignment of FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 05000250 the Control Room Emergency Ventilation System. A 2-3 minute delay in actuating the emergency pressurization mode could easily be tolerated without increasing the control room dose. The LOCA control room dose analysis does not explicitly model the time sequence of events between event initiation and the time it takes for the release plume to reach the control room ventilation system.
There are many inherent delays between the occurrence of a LOCA and the arrival of the plume at the control room boundary. For example, it takes a certain amount of time after the primary system break has occurred for the fuel to heat up to the point at which clad damage will occur (the gap release phase). It takes an additional amount of time for the released gap activity to pass through the reactor vessel and enter the containment atmosphere (the in-vessel phase). Once released to the containment atmosphere, it will take an additional amount of time for the gap activity to leak across the containment boundary. Meteorological delays will also exist as the activity is transported to the control room boundary.
The latest industry information regarding the timing of the "gap release" and "in-vessel" phases is provided in Regulatory Guide (RG) 1.183 - July 2000, "Alternative Radiological Source Terms For Evaluating Design Basis Accidents at Nuclear Power Reactors." Although Turkey Point uses the traditional TID-14844 source term for the LOCA analysis, the accident timing information contained in RG 1.183 is applicable to any PWR or BWR. RG 1.183 states that for facilities such as Turkey Point that are licensed with leak-before-break methodologies, the gap release phase may be assumed to start 10 minutes after the initiation of a LOCA. The duration of the gap release phase is reported to be 30 minutes. The in-vessel phase immediately follows the gap release phase and reportedly lasts for an additional 1.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Given these time frames, it is evident that a 2-3 minute delay in establishing control room pressurization and recirculation following the onset of a LOCA would not measurably impact operator doses.
A review of potential failure modes for the SF-1A and SF-1B supply fans indicates that there are a limited number of failures that would cause a malfunctioning system to go undetected by the control room operators. For example, the supply fans are small belt-driven centrifugal fans. Failure of the SF- 1B supply fan belt, shaft, or fan wheel in the as-found system configuration would provide indication that the SF-1B fan was operating as designed, even though it was providing no air flow. With D-21 mispositioned as-found, the low flow alarm would not be actuated due to high system residual flow. If the emergency recirculation system actuated during that time, it is reasonable to conclude that inoperability of both of the supply fans would go undetected by the operators during performance of because:
a. the fan components are not subjected to any fatigue initiating failure conditions e.g., long term exposure to flow induced vibration, excessive operating cycles, b. they are located in a controlled environment and are fully compatible with the internal and external service conditions, and c. they are small fans (12.25-inch wheel diameter) and have low component stresses during operation.
The low probability of occurrence is supported by the fact that the NRC considered failures beyond the electric motor to be not credible (letter from NRC to FPL dated 9/2/83, "Control Room Habitability, NUREG-0737 Item No. III.D.3.4, Request for Additional Information).
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 05000250 Although the likelihood of such a fan belt or shaft failure is remote, Westinghouse re-calculated the postulated control room LOCA dose rates without any operating supply fans. Based on the as-found condition, a residual system flow of 250 cfm was assumed to exist in the filter / recirculation loop due to the action of the operating control room air handling units. Flow measurements in the fresh air intake header indicated that there was essentially no makeup air constituent in the residual flow stream.
Thus, the analysis assumed that the entire 250 cfm residual flow rate was filtered recirculation air. The assumed control room unfiltered inleakage was double that assumed in the current LOCA analysis.
This increase in unfiltered inleakage accounts for the fact that little or no pressurization of the control room may be expected in the as-found configuration with no supply fans operating.
As stated in the Turkey Point Updated Final Safety Analysis Report (UFSAR), the dose criteria for control room personnel following the design basis LOCA are 5 rem whole body, 30 rem thyroid, and 30 rem J3- skin (or 75 rem 13-skin with protective clothing). The control room limiting dose predicted by Westinghouse for the above scenario is 27.8 rem thyroid.
The above dose analysis is based on the radiological source term as defined in USAEC Technical Information Document TID-14844, Calculation of Distance Factors for Power and Test Reactor Sites, 1962. This source term is very conservative in that it assumes the noble gases and radioiodine fractions are released immediately to the containment atmosphere at the start of an accident. It also assumes that the predominant chemical form of the radioiodine is elemental iodine, which is less reactive than other chemical forms in the core inventory. An alternate source term such as that established in RG 1.183 would assess much lower dose rates than that predicted by TID-14844 because it would appropriately model the radiological release as a time-dependant process. An alternate source term would also use radioiodine release fractions that are based on latest industry data. This alone would have a significant impact on the calculated dose rates since the latest industry data indicates that elemental iodine is only a small fraction of the radioiodine release composition. A newer source term would also model the natural removal processes for radioiodine, effectively reducing the quantity of radioactive material that is available for release to the environment.
Based on the above compensatory measures, failure of the SF-1A fan to automatically start on low flow due to a failure of the SF-1B fan would not result in exceeding 10 CFR 50, Appendix A, General Design Criterion 19, Control Room limits and would not significantly degrade plant safety.
CORRECTIVE ACTIONS
1. Damper D-21 was adjusted to provide proper recirculation air flow and the Control Room Emergency Ventilation Operability Test was performed to return the system to service.
2. A locking device was placed on system damper D-21 to prevent mispositioning.
3. A modification will be made to allow a locking device to be placed on system damper D-20 to prevent mispositioning.
4. Administrative controls will be put in place to ensure that dampers D-20 and D-21 remain in their locked positions.
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 05000250 5. The low flow setpoint of FS-6659A will be changed to create greater margin between system "no fan" recirculation flow conditions and the low flow switch setpoint.
6. A walkdown of all safety related and Maintenance Rule Risk Significant HVAC systems at Turkey Point was performed to identify additional HVAC related components warranting administrative controls to prevent inadvertent position changes. An Auxiliary Building Exhaust System damper was identified as requiring administrative control and will be lock wired in its required position.
Applicable procedures will be changed to denote the required damper position.
ADDITIONAL INFORMATION
No previous similar events related to mispositioning of safety related system dampers are known.
component function identifier (if appropriate)].
Nn FORM 366A (6-1998)