05000325/LER-2006-003

LER-2006-003, Control Room Emergency Ventilation (CREV) System Inoperable due to Chlorine Detection Modification Deficiency

Brunswick Steam Electric Plant (Bsep), Unit 1
Event date:	1-0-2006
Report date:	06-07-2006
Reporting criterion:	10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
Initial Reporting
ENS 42488	10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
3252006003R00 - NRC Website

Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

INTRODUCTION

At 1630 hours0.0189 days <br />0.453 hours <br />0.0027 weeks <br />6.20215e-4 months <br /> on April 10, 2006, plant personnel identified a potential failure mode of the recently modified chlorine detection system. The failure mode has the potential to render the Control Room Emergency Ventilation (CREV) system [VI] inoperable following power restoration after a Loss of Offsite Power/Loss of Coolant Accident (LOOP/LOCA) event. Due to this design deficiency, the CREV system was declared inoperable per Technical Specification (TS) 3.7.3, "Control Room Emergency Ventilation System," which placed Units 1 and 2 in Condition B of TS 3.7.3. Units 1 and 2 entered TS 3.7.3 Required Action B.1 (i.e., be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), for two CREV subsystems inoperable. In addition, the modification affected the smoke protection mode of the CREV system and both units entered Condition B of Technical Requirements Manual (TRM) 3.18, "CREV System - Smoke Protection Mode." The chlorine protection mode of the CREV system was not affected by the design deficiency.

At 2333 hours0.027 days <br />0.648 hours <br />0.00386 weeks <br />8.877065e-4 months <br />, the NRC was notified of this event (i.e., Event Number 42488) in accordance with 10 CFR 50.72(b)(3)(v)(D), as an event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

This event is being reported in accordance with 10 CFR 50.73(a)(2)(v)(D), as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

EVENT DESCRIPTION

Initial Conditions Prior to the event, both Units 1 and 2 were in Mode 1. Unit 1 was operating at approximately 95 percent rated thermal power and Unit 2 was operating at approximately 100 percent rated thermal power. All required safety-related systems for both units were operable, with the exception of Emergency Diesel Generator No. 1 [EK], which was removed from service for scheduled surveillance testing.

Discussion The CREV system is required to provide protection to the operators for three types of events: a radiation event, up to and including a Design Basis Accident; a toxic gas event (i.e., complete rupture of the chlorine tank car, or a slow leak lasting for an extended period of time); and an external smoke event. In the event of a chlorine release, the CREV system enters a full recirculation mode (i.e., chlorine protection mode), with no outdoor air intake. The emergency filtration trains do not start, since they do not effectively remove chlorine and may be damaged by the presence of chlorine. Protection for chlorine gas "overrides" any concurrent, ongoing, or subsequent radiation or smoke initiation signals. The override design offers protection to EVENT DESCRIPTION (continued) operations personnel in the control room against potentially fatal chlorine gas releases. This protection is required any time the chlorine tank car is within the exclusion area.

On February 3, 2006, a modification was implemented to replace obsolete detectors in the chlorine detection system. Late in the modification design process, a potential condition was identified where the new chlorine detectors may place the CREV system in the chlorine isolation mode upon restoration from an extended loss of power, thereby overriding the smoke and radiation protection functions of the CREV system. Procedure revisions were made to respond to this potential event by manually resetting the detectors within 20 minutes, consistent with the Alternative Source Term (AST) assumption of manual CREV initiation within 20 minutes.

Subsequently, on March 3, 2006, another modification that affected the same general system logic was implemented. This modification, performed to support increasing the Main Steam Isolation Valve (MSIV) [SB] leakage rates, implemented an auto-start of the CREV system in the radiation mode in the event of a LOCA. The revised AST analysis assumed that CREV initiation would occur within two minutes of the event to preclude exceeding the dose limit criteria for the main control room. License Amendment Nos. 239 and 267, implemented at BSEP on March 3, 2006, incorporated the increased allowable MSIV leakage rates and the corresponding two minute auto-start requirement of the CREV system in the radiation mode.

On April 10, 2006, engineering personnel, reviewing questions raised by an operations simulator training observation, determined that the potential existed for the chlorine detection modification to negate the CREV auto-start function. Upon investigation, it was determined that the Responsible Design Engineer for the chlorine detection replacement modification, who was a long-term contract engineer at BSEP, was unaware of the auto-start requirement of the MSIV allowable leakage modification. Additionally, the Control Building Ventilation System Engineer was unaware of the late changes to the chlorine detection modification that required the remote, manual reset of the detectors. Without the communication of this critical design information, the interrelation between the two modifications was not identified, and the chlorine detection modification rendered the auto-start feature ineffective and the two minute timeframe assumption became invalid.

Because of the design deficiency, the radiation and smoke detection modes of the CREV system were declared inoperable and both Units 1 and 2 entered Condition B of TS 3.7.3 (i.e., be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />), and Condition B of TRM 3.18. Actions were taken to remove the chlorine tank car from the exclusion area and exit the mode of applicability of TRM 3.19, "CREV System - Chlorine Protection Mode." When this was accomplished, the chlorine detectors were disabled and operability of the CREV radiation and smoke protection modes was restored at 2100 hours0.0243 days <br />0.583 hours <br />0.00347 weeks <br />7.9905e-4 months <br /> on April 10, 2006. Reactor power was not reduced on either unit as a result of this event.

EVENT CAUSE

The root cause of this event is ineffective design review of the chlorine detector modification prior to approval. Changes to the chlorine detector replacement modification, which directly affected system design and performance, were not reviewed with previous reviewers prior to approval, as required by procedure EGR-NGGC-0005, "Engineering Service Requests." The Responsible Design Engineer did not recognize that the change in the system operating characteristics was significant enough to send the modification package back through the review process.

SAFETY ASSESSMENT

The safety significance of this condition is considered minimal. The CREV system provides radiation, smoke, and chlorine protection for the operators. The system is a standby system that is common to both Units 1 and 2. The safety function of the CREV system is the radiation protection portion of the radiation/smoke protection mode and includes two redundant high efficiency air filtration subsystems for emergency treatment of recirculated air and outside supply air. In Modes 1, 2, and 3, the CREV system must be operable to control operator exposure during and following a Design Basis Accident. The postulated scenario of a LOOP coincident with a LOCA has a very low probability of occurrence. From a Probabilistic Risk Analysis perspective, these are two independent events, with each individually having a low probability of occurrence. There is a much lower probability of occurrence of a LOOP coupled simultaneously with a LOCA, and has the frequency of occurring every 1E-7 years (i.e., once in 10 million years).

The plant staff took immediate and proper actions to return the CREV system to operable. The chlorine tank car was removed from site and the chlorine detectors were disabled. The CREV system was considered inoperable from the time License Amendment Nos. 239 and 267 for BSEP Unit Nos. 1 and 2, respectively, were implemented on March 3, 2006, until April 10, 2006, at 2100 hours0.0243 days <br />0.583 hours <br />0.00347 weeks <br />7.9905e-4 months <br /> when the on-site actions were completed.

For the time period that the CREV system was determined to be inoperable, performance of plant personnel and equipment in the control room was not adversely affected. There was no nuclear or industrial safety consequence from this event.

CORRECTIVE ACTIONS

• Operability of the CREV system was restored at 2100 hours0.0243 days <br />0.583 hours <br />0.00347 weeks <br />7.9905e-4 months <br /> on April 10, 2006, when the removal of the chlorine tank car from the site and disabling of the chlorine detectors to prevent them from actuating was complete.

CORRECTIVE ACTIONS (continued)

• The chlorine detection replacement modification will be revised to ensure that the detectors will not return to service in an alarmed state upon restoration from a loss of power unless legitimate chlorine detection is received.

• Procedure EGR-NGGC-0011, "Engineering Product Quality," will be revised to add a checklist that will require a final modification review prior to the Supervisory sign-off.

• Engineering Support Personnel Training will be conducted to incorporate lessons learned.

PREVIOUS SIMILAR EVENTS

A review of LERs and corrective action program condition reports for the past three years identified the following similar events:

• LER 1-2005-004, dated July 11, 2005, documents a condition where the CREV and Control Room AC systems were declared inoperable when electrical power was lost to bus El, making the 2B Compressor inoperable. The 2A Compressor should have automatically started, but did not start due to a wire lug that had broken and interrupted the control power circuit. The corrective actions associated with LER 1-2005-004 could not have reasonably been expected to prevent the condition reported in this LER.

• LER 1-2006-001, dated March 9, 2006, documents a condition where the CREV system was declared inoperable when the 2B Control Building instrument air compressor failed and the CREV system shutdown due to loss of control air. The root cause of this event was determined to be ineffective condition monitoring of compressor oil pressure to detect degradation of the compressor. The corrective actions associated with LER 1-2006-001 could not have reasonably been expected to prevent the condition reported in this LER.

Fenwal Temperature Switch Replacement modification (i.e., Engineering Change 56360), and the Unit 2 Heater Drain Level Control modification (i.e., Engineering Change 46895). Human performance issues, including inadequate modification reviews, were identified as the root cause of these deficiencies. The corrective actions associated with NCR 158188 could not have reasonably been expected to prevent the condition reported in this LER because the corrective action to prevent recurrence was tailored toward engineering knowledge associated with digital modifications and not the adequacy of design reviews.

COMMITMENTS

No regulatory commitments are contained in this report.