05000390/LER-2009-001
| Watts Bar Nuclear Plant | |
| Event date: | 05-27-2009 |
|---|---|
| Report date: | 07-27-2009 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material |
| 3902009001R00 - NRC Website | |
I. PLANT CONDITIONS:
The events in this LER began May 27, 2009, while the unit was at 100% power. The plant remained at 100% power for the events described in this LER.
II. DESCRIPTION OF EVENT:
A.�Event:
On May 27, 2009, WA discovered that the Surveillance Instruction (SI) in place to satisfy Surveillance Requirement (SR) 3.7.12.4 for verifying operability of the Auxiliary Building Gas Treatment System (ABGTS) Trains every eighteen months on a staggered test basis had never adequately tested the system because non-safety related dampers [Energy Industry Identification System (EllS) Code CDMP] beyond the test boundary were closed during prior testing, which had potential to mask leakage through the safety related boundary valves (EllS Code VTV) and dampers.
At 11:55 on May 27, 2009, when this was discovered, WA considered the condition to constitute a missed surveillance and entered SR 3.0.3 to allow time to perform the appropriate test. This decision was supported by industry benchmarking that indicated such response was standard practice. SR 3.0.3 provides a delay period to allow performance of a missed surveillance before declaring the LCO not met, and requires a risk evaluation if the delay is more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. WA began to revise the surveillance instruction immediately to enable a prompt retest with the proper alignment to confirm operability of the ABGTS. TVA notified the NRC resident inspector at approximately 13:30 of the problem with the surveillance instruction and the entry into SR 3.0.3.
WA subsequently shut down all Auxiliary Building (AB) General Ventilation and verified that the non-safety related dampers were in the closed position. This ensured that the AB Secondary Containment Enclosure (ABSCE) was in a known tested configuration and would continue to support ABGTS operability. ABGTS was considered operable but non-conforming, and securing AB General Ventilation was a compensatory action to ensure operability.
While shutting down the AB General Ventilation fans (El IS Code FAN), three temporary doors (R001, R002, and R003) (EllS Code DR) to the Unit 2 Reactor Building failed. These doors had been installed to facilitate Reactor Building. (See Figure 1) The failure of the two fabric doors caused a breach in the ABSCE that exceeded ABGTS capability to maintain a negative pressure. As a result, WBN entered Technical Specification (TS) Limiting Condition of Operation (LCO) 3.7.12, "ABGTS," Condition B for two trains of ABGTS inoperable in Modes 1, 2, 3, and 4. One temporary boundary door was repaired, which reestablished the necessary ABSCE Boundary, and WBN exited LCO 3.7.12 Condition B.
A. Event (continued):
LEGEND:
I=M 1 MOTOR CPj CONTROL PANEL 1 / / / / / / I/ / / / / / / / / / / 1
FIRE RATED WALL
r i / / / /// fl // I / /Auxiliary Building j,.
ROLLUP STEEL DOOR
0-000R-41O-Roul
WA L
Unit 2 Containment INNER FABRIC DOOR 0-D00R-410-R002
OUTER FABRIC DOOR
O-DOOR-41 0-P005
ACP
} Figure 1, Sketch of Temporary Doors Arrangement TVA then conducted the revised required SI on Train A. For testing purposes, LCO 3.7.12 Condition A was entered for one train of ABGTS being inoperable and LCO 3.0.5 was entered to allow testing to demonstrate operability. Train A did not pass the initial test on May 28. Repairs were made to two safety related dampers.
Local tests were performed to determine the improvement of these two dampers. Because the improvements made to these two dampers were minor and previous testing had identified that other ABSCE boundary components were acceptable, WA suspected that the system alignment may not have been correct at the time of the failed SI test. Proper system and pressure boundary test alignment was verified and the revised required SI for Train A was performed again. The results of this test were acceptable. Train A passed the SI and TVA exited LCO 3.7.12 Condition A.
LCO 3.7.12 Condition A and LCO 3.0.5 were entered on May 30 to perform the revised required SI on Train B. Train B did not pass the initial test. After repairs were made to several safety related dampers, the test was performed again on the evening of May 31. This test was performed with the AB Railroad Bay Door, Door A112, closed, and also performed with the Railroad Bay door open. Train B passed the SI with the Railroad Bay door closed, but failed with the Railroad Bay Door open. The Railroad Bay Door was tagged shut and LCOs 3.7.12 and 3.0.5 were exited. Upon the successful testing of Train B and the prior success of Train A, full compliance with the TS was established, and the open SR 3.0.3 log entry was exited.
0 2009 001 A. Event (continued):
While starting Unit 2 AB general ventilation on June 27, differential pressure again exceeded capacity of the ABSCE temporary boundary doors. Two ABSCE temporary boundary doors (R002 and R003) failed and WBN entered LCO 3.7.12 Condition B. One ABSCE temporary boundary door was repaired and tested satisfactorily within the allowed completion time and WBN exited the LCO Condition.
This series of events is addressed in TVA's Corrective Action Program as Problem Evaluation Reports (PERs) 172256, 172301, and 175160.
B. Inoperable Structures, Components, or Systems that Contributed to the Event No structures, components, or systems were inoperable that contributed to the event besides the aforementioned ABGTS trains and ABSCE temporary boundary doors.
C. Dates and Approximate Times of Major Occurrences Date�Time� Event May 27, 2009�1155 SI was determined to be inadequate to confirm ABGTS operability and SR 3.0.3 was entered for the missed surveillance.
1743 AB general ventilation was shut down to ensure ABGTS was in a known, tested condition.
1905 WBN entered LCO 3.7.12 Condition B because ABSCE temporary boundary doors had failed while shutting down AB General Ventilation.
2239 The ABSCE boundary was restored by repair of one of the damaged doors, and LCO 3.7.12 Condition B was exited.
May 28, 2009�0900 LCO 3.7.12 Condition A and LCO 3.0.5 are entered to allow for Train A testing.
May 30, 2009�0625 Upon successful completion of Train A testing with the revised SI, LCO 3.7.12 Condition A and LCO 3.0.5 are exited.
0642 LCO 3.7.12 Condition A and LCO 3.0.5 are entered to allow for Train B testing.
June 1, 2009�1006 Upon successful completion of Train B testing with the revised SI, LCO 3.7.12 Condition A and LCO 3.0.5 are exited. Additionally, the SR 3.0.3 entry logged at 1155 on May 27 was closed and exited since both trains of ABGTS have had the appropriate SI testing performed.
June 27, 2009 1320 WBN entered LCO 3.7.12 Condition B because ABSCE temporary boundary doors had failed while starting Unit 2 AB General Ventilation.
1649 The ABSCE boundary was restored by repair of one of the damaged doors, and LCO 3.7.12 Condition B was exited.
D. Other Systems or Secondary Functions Affected
No other systems were affected by this series of event.
E. Method of Discovery
Engineering preparations for the next scheduled performance of the surveillance revealed the discrepancy between the SI and the design criteria, as documented in PER 172256. Subsequent failures of the temporary boundary doors were discovered upon occurrence and reported to the control room.
F. Operator Actions
The operations staff (licensed personnel) entered TS SR 3.0.3 considering that this situation constituted a missed surveillance, based on benchmarking industry experience. SR 3.0.3 provides a delay period to allow performance of a missed surveillance before declaring the LCO not met, and requires a risk evaluation if the delay is more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Based on subsequent review of a recent enforcement action and Task Interface Agreement (TIA) 2008-004 for a similar situation at Pilgrim Nuclear Plant, this type of situation will be considered as a condition prohibited by TS in the future.
G. Safety System Responses
There were no safety system responses as a result of this condition.
III.�CAUSE OF EVENT During initial SI development WA failed to recognize that the AB General Ventilation configuration beyond the test boundary could potentially mask leakage. This condition was not fully realized until May 27, 2009.
The failure of the ABSCE temporary boundary door failures during AB general ventilation shut down was the result of the design of these doors not being sufficiently analyzed for the pressure differential seen during AB general ventilation start up or shut down.
The cause of the second ABSCE temporary boundary failure during AB General Ventilation realignment was determined to be an inadequate and untimely resolution of an identified problem. TVA failed to implement appropriate constraints identified during the first root cause investigation before operating the AB ventilation fans again on June 27, 2009. A standing order had been issued immediately following the first ASBSCE door failure providing cautions for start up or shut down of all AB General Ventilation, but did not address concerns with routine ventilation realignments.
IV. ANALYSIS OF THE EVENT
The ABGTS is a fully redundant air cleanup system that is provided to reduce radioactive releases from the ABSCE to the environment during an accident to levels sufficiently low to keep the site boundary dose rates below the requirements of 10 CFR 100. This is accomplished by exhausting air from the ABSCE to maintain a negative pressure within the boundary. Exhaust air leaving the ABSCE is processed by the ABGTS filters before it is discharged to the outside.
This event began as a noncompliance with the WBN TS, with minor safety significance. The ABGTS would have performed its intended safety function in the event of an accident requiring ABGTS. Repairs made to safety-related dampers during Train A testing did improve the leak tightness of the ABSCE, but review of the test data indicates the A train would have met the acceptance criteria without the benefit of the repairs. The nonsafety related dampers close automatically upon receipt of an AB Isolation (ABI) signal, which would place the system into a tested configuration. These dampers close automatically when their associated fans are off, and the dampers fail in the closed position. Train A would have been able to perform its intended safety function to mitigate the consequences and control radioactive releases had a Design Basis Accident occurred, as assumed in the safety analysis. Train B was not capable of performing its design function without the support of the nonsafety related dampers until repairs were made to the safety related dampers.
When the temporary ABGTS boundary doors were damaged, immediate corrective actions were pursued.
During these periods, no events requiring ABGTS to perform its safety function occurred. These corrective actions were taken to place ABGTS and ABSCE into a condition that would effectively mitigate a release to the environment in the event of a design basis event.
V. ASSESSMENT OF SAFETY CONSEQUENCES
In the highly unlikely event of a design basis Loss of Coolant Accident (LOCA) or Fuel Handling Accident, the breach of the interim ABSCE doors for several hours on 5/27/09 and 6/27/09 is considered to be of low safety significance.
There were no movements of irradiated fuel or heavy load lifts on the refueling floor during the ABSCE breach conditions so the Fuel Handling design basis accident was not credible during that time.
Both Trains of ABGTS were available during both failures of the temporary ABSCE boundary doors. Thus, twice the Tech Spec 3.7.12 filtration flow was available to mitigate any radiation releases in the event of a LOCA. Although the Tech Spec required -0.25 inches WG or greater vacuum condition was not achievable based upon the total inleakage area due to the opening in the ABSCE, a vacuum would have been maintained absent severe weather or wind conditions that could cause atmospheric pressure to be lower than AB vacuum at the refueling floor. Wind speed and direction were stable during the times of the ABSCE Reactor Building volume and associated penetrations to atmosphere. The estimated inleakage through the ABSCE breach with two trains of ABGTS in service is approximately 78 feet per minute. As a reference, Industrial Ventilation, 19th edition, Section 4, on Hood Design, recommends a minimum face velocity of 100 feet per minute for laboratory fume hoods used in low activity radioactive laboratory work. Given the negative face velocity at the ABSCE breach is comparable, the percent of airborne contaminants that could escape would be small. In addition any leakage via this breach would be into the Unit 2 containment structure, which would further serve to mitigate the amount of unfiltered leakage.
VI.�CORRECTIVE ACTIONS- The corrective actions are being managed within TVA's Corrective Action Program (PERs 172256, 172301, and 175160). An overview of the corrective action plan is provided below:
A.�Immediate Corrective Actions:
1. Upon discovery of the inadequate SI, SR 3.0.3 was entered and the plant was placed into a known, tested configuration to ensure ABGTS operability. The ABGTS was considered operable but non conforming with securing AB General Ventilation as a compensatory action.
2. A one-time modification of the inadequate SI was prepared to prevent the nonsafety related dampers from masking air leakage through ABSCE boundary dampers while testing. Access ports located between the safety related dampers and the nonsafety related dampers were opened to prevent the nonsafety related dampers from performing any boundary function. The modified SI was performed to verify the adequacy of the ABGTS with ABSCE boundary leakage that was not masked by nonsafety related dampers.
3. Upon discovery of the initial ABSCE breach, LCO 3.7.12 Condition B was entered and actions were taken to restore the boundary. Standing Order 09-011, "Interim Guidance for AB General Vent System," was issued to control AB General Ventilation startup and shutdown.
4. Upon discovery of the second ABSCE breach, LCO 3.7.12 Condition B was entered and actions were taken to restore the boundary. The Unit 2 Reactor Building Equipment Access Door was closed and tagged shut. This door was tested to ensure it would mitigate the consequences of AB General Ventilation induced pressure changes on the temporary ABSCE boundary doors. Configuration of this door is controlled by Unit 1 Operations Shift Manager.
B.�Corrective Actions to Prevent Recurrence:
1. A review of other HVAC system Sls that could be affected by a similar configuration was performed.
It was determined that the Emergency Gas Treatment System (EGTS) could have been affected because there are nonsafety related dampers located in series with the safety related valves intended to maintain the annulus pressure boundary. A review of previous test data identified that the leakage through the nonsafety related dampers is at an unacceptably high rate, and these nonsafety related dampers do not mask leakage through the safety related dampers.
2. ABGTS and EGTS Sls have been placed on hold, and will be revised before their next use.
3. The design change impact review process will be improved to evaluate unique applications, worst consequence of failure, non-conservative design criteria or reduction in design margin, deviation from SSCs in similar applications, and adverse impacts from non-quality SSCs.
4. Evaluate and revise the PIDP-6, "Root Cause Analysis," investigation process to highlight the need for the RCA team to reassess existing interim actions for adequacy as new problems are identified during the investigation, and to communicate and track additional action items.
VII.�ADDITIONAL INFORMATION
A. Failed Components
The failed components were the ABGTS isolation dampers and temporary ABSCE boundary doors.
This has been discussed previously, and no additional failed components contributed to this event.
B. Previous LERs on Similar Events There have been other instances at WBN where unacceptable breaches of the ABSCE boundary have occurred. However, the two instances discussed in this report were due to temporary boundary doors with an inadequate design, and WBN has identified no similar events.
C. Additional Information:
None.
D. Safety System Functional Failure This event included a safety system functional failure each time that both temporary fabric doors were inoperable.
E. Loss of Normal Heat Removal Consideration There was no loss of normal heat removal due to this condition.
VIII. COMMITMENTS
None.