05000305/LER-2004-003

LER-2004-003,

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
3052004003R01 - NRC Website

FACILITY NAME (1) DOCKET NUMBER (2) � LER NUMBER (6 PAGE (3) Kewaunee Nuclear Power Plant 2004 -- 03 -- 01

Event Description:

On 8/12/2004, while the plant was operating at full power, Kewaunee Nucleat Power Plant (KNPP) on-shift personnel discovered a control room [NA] emergency zone (CREZ) barrier door [DR] not fully closed. The position of the door had an adverse affect on the control room post-accident habitability analysis assumption for air in-leakage to the control room envelope. This, in-turn, was judged to have an adverse affect on the Technical Specifications (TS) operability requirements for the Control Room Post-Accident Recirculation (CRPAR) system [VI]. Consequently, with the door less than fully closed, the CRPAR system was considered not capable of fulfilling its post-accident mitigation function to ensure a habitable control room under post-accident conditions. The as-found condition was immediately corrected, the control room envelope was fully restored, and the CRPAR system was returned to operable status within the TS time limitations.

Kewaunee TS, Section 3.12, "Control Room Post-Accident Recirculation System," specifies the operability requirements for the CRPAR system. Section 3.12.a specifies that, "[t]he reactor shall not be made critical unless both trains of the Control Room Post-Accident Recirculation System are OPERABLE.

The Kewaunee system design has two trains of CRPAR equipment. Each train consists of ventilation fans [FAN], filters [FLT], dampers [DMP], and associated ductwork [DUCT]. The primary function of the system is to isolate the control room envelope, recirculate the control room air volume and filter contaminants assumed being released from the reactor coolant system [AB] and introduced into the control room envelope under postulated accident conditions. Each train of the system has the full capacity to remove contaminants to ensure control room personnel exposure within acceptable limits.

Inherent in the assumptions for the system to operate according to design is that all barriers between the control room, adjoining plant areas and the outside environment remain intact. Included in the assumptions is any door permitting access and egress to adjoining areas with the control room envelope remain intact and closed when they are not needed to be opened to support plant operational activities including maintenance. Reliance on a closed barrier system is necessary due the analysis assuming a specific amount of in-leakage to the control room envelope.

The bulk of the Kewaunee control room envelope, referred to as the "Control Room Emergency Zone (CREZ)," includes; the normally manned control room, the instrument and control equipment relay room (directly below the control room), and the control room ventilation equipment room (directly above the control room). The door found less than fully closed was one of a set of two double doors in the control room ventilation equipment room. This set of double doors is designated as door #152.

The part of door #152 found ajar (not fully closed) is a normally closed and latched passive design. This half of the door has mechanical latches at the upper and lower ends of the door at the edge away from the hinged part of the door. Normal personnel access and egress through door #152 would be through the opposite door. The opposite door has an automatic closure mechanism with a door seam edge (astragal) that overlaps onto the passive door. While on the normal operating equipment tour, the Operations staff, on-shift Nuclear Auxiliary Equipment Operator (NAO) noted that the passive door was not fully closed. The passive door was found resting against the active door's astragal. The overlap design prevented the passive door from closing completely. As a result, a gap at the passive door's hinged edge, and the upper FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) Kewaunee Nuclear Power Plant 05000305 YEAR 2004 — 03 — 01 and lower ends of the door was created. The gap created an air flow path across the CREZ boundary to the other side of the door.

Procedure guidance for the plant's barrier control program is prescribed by Fire Plan Procedure, FPP-08- 09, "Barrier Control." The proceduralized limit for openings in the CREZ without additional analysis is three square inches unless the reactor is sub-critical. In the as-found condition, the additional open area around the door's perimeter exceeded the three square inch operational limit.

Kewaunee analysis for control room personnel exposure assumes approximately 200 standard cubic feet per minute (scfm) unfiltered air in-leakage to the control room envelope. With the door less than fully closed, this analysis assumption could not be assured.

Event Analysis:

This event is being reported in accordance with the requirements of 10CFR50.73(a)(2)(v)(D), any event that could have prevented the fulfillment of a safety function of a system needed to mitigate the consequences of an accident. With the control room ventilation equipment room door less than fully closed, the accident analysis assumptions used to assure acceptable control room personnel exposure could not be supported.

Consequently, the ability of the CRPAR system to protect control room personnel under post-accident conditions could not be assured. As a result, using analysis assumptions, the control room operator exposure potential could have resulted in unacceptable personnel exposure while performing post accident mitigative actions.

Safety Significance:

In-leakage to the CREZ is dependant on the pressure relationship between the control room envelope and its surrounding areas. Control room ventilation under normal or post-accident conditions is not assumed to be either a positive or negative ventilation system. Given the guidance available at the time that the Kewaunee control room habitability studies were performed, the assumed in-leakage value was used as a conservative input to calculate personnel exposure potential. A specific amount of gross contaminants in cubic feet was assumed to enter the CREZ before the CRPAR system isolated the control room from surrounding areas, and a continuous unfiltered in-leakage rate was assumed for conservatism. The assumed volume of gross leakage and the continuous unfiltered in-leakage is used to determine the effectiveness of the CRPAR system to recirculate and filter the control room environment.

The door that was found ajar was one of the double doors that provide the primary controlled barrier between the control room ventilation equipment room and the radiologically controlled auxiliary equipment building [NF]. Specifically, the double doors lead to one of the plant's two auxiliary building freight elevators [ELEV]. The elevator is occasionally used to transfer bulky heavy objects up to the control room equipment room. In addition to the double doors, at the elevator entrance, there is a standard set of solid freight elevator doors. These do not provide an airtight seal between the CREZ and auxiliary building. However, they do provide some limitation of gross air exchange across the barrier if the controlled boundary doors are left open.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) 2004 — 03 — 01 The auxiliary building elevator shaft communicates directly with the outside of the auxiliary building through small openings in the elevator equipment room. The elevator shaft also passes through the auxiliary building's engineered safeguards special ventilation zone [VF], Zone SV. Under post-accident conditions, the Zone SV ventilation system operates to filter in-leakage into the auxiliary equipment building from the containment building annulus and from systems that communicate with the containment. The special ventilation system also operates to maintain the zone at a negative pressure in relationship to the outside atmosphere and surrounding plant areas. The Zone SV system capability is tested and confirmed to function as designed according to the plant's periodic surveillance testing program. Consequently, the flow path of air between the auxiliary building elevator shaft and the control room ventilation equipment room is from the equipment room into the elevator shaft. Therefore, there would be no in-leakage to the CREZ from the radiologically controlled area of the auxiliary equipment building through the greater door gaps.

Since the air flow caused by the unclosed boundary door is out of the CREZ, it is assumed that the leakage paths into the control room envelope from other areas would be adversely affected. How much additional unfiltered in-leakage would be brought into the CREZ is indeterminate. Any increased leakage into the envelope would be a function of any change in differential pressure between the CREZ and auxiliary building along with the material condition of the rest of the CREZ boundary sealing surfaces' ability to pass additional air. No data is available to perform calculations of differential pressures across the boundaries' potential flow rates. However, considering that the analysis assumes the control room habitability exposure based on a single train of CRPAR being available, and the fact that at no time during the time the door was opened were both trains CRPAR inoperable, the consequences of any additional in-leakage is judged to be minimal.

The potential for an over exposure condition is further minimized by the conservative assumptions used and exposure limitations required to address control room habitability. The primary contributor to post accident control room exposure is a large quantity of a direct containment [NH] to atmospheric release being assumed. This assumption takes no credit for the additional Kewaunee plant design of having a containment annulus that would limit, if not eliminate, the assumed release. The most recent and historically the plant's typical measured containment penetration leakage test data also shows only a fraction of the allowed design leakage from the containment building penetrations. The current filter conditions test data and performance requirements compared to the TS limits and the assumed filter efficiencies for CRPAR post-accident assumption purposes provide additional margin.

An analysis was performed relative to the effects of smoke and hazardous chemicals with door #152 ajar.

Door #152 between the control room equipment room and the auxiliary building elevator shaft will not affect the ability of the control room operators to monitor and control the plant in the event of smoke or a hazardous chemical spill. Updated Safety Analysis Report (USAR) section 9.6.4 states:

A smoke detector mounted in the return air duct will automatically close a damper in the return air duct, thereby causing all air to be exhausted into the Turbine Building and making the Control Room a 100% makeup system. Thus, in the unlikely event of a Control Room fire, continued occupancy by the operators is possible. In addition, breathing masks and fresh-air supply units are available for operator use in case of such an emergency.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) 2004 — 03 — 01 There is no exhaust fan installed for smoke removal. Making the control room ventilation system a 100% makeup system allows for once-through operation. Smoke will not recirculate back through the ventilation system and the control room. Realigning the ventilation system to 100% outdoor air will substantially increase the flow rate of outdoor air, and subsequently maintain a positive pressure in the control room.

Original design calculations further show the CREZ will be at a positive pressure with respect to atmosphere.

USAR section 9.6.3 states the Auxiliary Building Ventilation was designed:

To insure that the building is under a slight negative pressure, total air exhaust quantity always exceeds supply air quantity (by typically a minimum of 10% during normal operations).

Based on the above, whenever the control room ventilation system is in the smoke removal mode there will be a pressure difference from the CREZ equipment room to the auxiliary building. Smoke will not flow from the lower pressure auxiliary building to the CREZ.

The hazardous chemical analysis is based on the concentration at the control room outdoor air intake (Updated Control Room Habitability Evaluation Report dated February 1989). This evaluation shows that the control room remains habitable in the event of a hazardous chemical spill of the quantities stored on-site, or a spill of those chemicals stored or transported within 5 miles of the plant. Hazardous chemical spills are not assumed to occur concurrent with a design basis radiological event. During normal ventilation, the outdoor flow rate is greater than that which is exhausted. Therefore, if a hazardous chemical spill were to occur (either outside the plant, or in the Turbine or Aux Buildings), the resulting air flow would not be into the Control Room envelope.

Cause:

Investigative efforts of the event showed that on 8/12/04 maintenance on the CRPAR system filter units was scheduled. To support the maintenance, filters were transferred from the auxiliary equipment building to the control room ventilation equipment room. This required using the freight elevator to move the filters to the ventilation equipment room. Therefore, the door appears to have been left open by personnel involved in moving the filters.

When the doors were opened to move the filters has not been exactly determined. Interviews with plant staff and electronic data security door access searches did not reveal specifically by who or when the doors were opened. However, the interviews and access data search did allow narrowing down the time that the door was open to less than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Without knowing specifically who may have opened the doors or who moved the filters between the two areas, a definitive basis for why the doors were not re-closed could not be determined. Additional details regarding the cause and causal factors for this event are still under investigation.

The direct cause of the door not being closed is assessed as failure of plant personnel to ensure the door was closed following maintenance. The maintenance schedule and interviews indicate that the filters were recognized as not being available for the maintenance at the beginning of shift. However, the maintenance was performed on that day which required the filters to be available. Therefore, the filters had to be brought FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) 2004 — 03 — 01 to the room that day and the only viable path was through the affected door. The door was identified as being open, or not fully closed, by the NAO on the first set of rounds at 1915 hours0.0222 days <br />0.532 hours <br />0.00317 weeks <br />7.286575e-4 months <br />.

The underlying causes of the failure are consider d to be deficiencies in the KNPP overall barrier control program. Program control guidance is limited to a single barrier control procedure, and for barrier control and identification purposes, labels and warnings are not sufficient to ensure barriers are easily recognizable for all their intended functions. The lack of programmatic controls appears to contribute to plant personnel lack of awareness in understanding barrier contr I functions and their importance.

Therefore, the cause of the event is attributed to deficiencies in the plant's barrier control programs. The contributing factors are:

• The majority of the information regarding various required barriers is contained within the Fire Plan Procedure, FPP-08-09. This one procedure provides identification, performance limitations, definitions and controls for virtually all play It barriers. The scope and areas of responsibility of the programs include the fire plan, high energy line break barriers, CREZ, Special Ventilation system barriers, security and flooding. This proce dure includes guidance and requirements related to doors, barrier penetrations, dampers, wall 3, floors and ceilings.

• Barrier labels, notably doors, are not suffi ient to forewarn plant staff of all potential barriers any given door may have an effect on. Conse uently, there is no assurance that personnel would be any more aware of a door that provides a specific design basis than any other door.

Corrective Actions:

As part of the plant's efforts to address Generic Letter (GL) 2003-001, "Control Room Habitability," design changes to the control room boundary system have been initiated. Included in the changes is a substantial change to the doorway that was involved in this event. Specifically, a new barrier that encapsulates the doors' opening is being installed. The new design, a gasketed and bolted enclosure, will still allow access and egress, however, it will be on a less frequent and on only a more plant strategic needs basis.

Two corrective actions for further evaluation of s ecific corrective action needs have been entered into the plant's corrective action program:

1. Review and evaluate the effectiveness of the plant's barrier control program as it may relate to problems encountered with failing to ensure all barriers are in their required positions/condition.

Currently the single program control document for barrier control, FPP-08-09 seems to be ineffective in ensuring personnel have guidance and the tools necessary to understand what is required for all the different plant barrier controls.

2. Review and evaluate plant policies for la eling doors to ensure ease of recognition to enhance personnel awareness and aid in underst nding of barrier control functions.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) 2004 -- 03 -- 01

Previous Similar Events:

None administrative quality, and timeliness. Technical quality reflects compliance with procedure and regulatory requirements, validation of information, and rigor. Administrative quality reflects presentation, format, style, and grammar.

Technical Quality:

No technical errors or omissions 4 points Minor errors or omissions, but not affecting overall quality 3 points More significant errors or omissions 2 points Very significant errors or omissions 1 point Fatal error 0 points Administrative Quality:

No typographical, grammatical or format errors 4 points Minor errors, but not affecting overall quality 3 points More significant errors or omissions 2 points Very significant errors or omissions 1 point Fatal error 0 points Timeliness:

Met site standard for delivery to final signer 2 points Didn't meet site standard for delivery to final signer 1 point Submittal missed due date 0 points Scoring: sum of points for a submittal (maximum of 10 points) Additional Information — If a zero is scored in any area, the human performance event clock should be reset. Consider writing an action request and resetting the clock if any points are lost.

Reviews should reflect quality as presented for the responsible manager's review and for the final signer's review (after technical reviews and licensing peer review). Maximum score on any submittal is 10 points. Each submittal in a calendar month is assigned a grade, with a monthly average score being calculated from all submittals for the month. The monthly score is plotted as the performance indicator.

Document: Reportable Occurrence 2004-003-01 � Document Date: 2/22/05 Date in for signature: 2/22/05

ELEMENT SCORE

Technical Quality (4,3,2,1,0) Administrative Quality: (4,3,2,1,0) Timeliness (2, 1, 0) J:ShareDataLICENSINGBPA Group FolderMenbome, NoreenMaster form copiesNEW Submittal Quality form.doc