05000390/LER-1917-007, Regarding Multiple Unreported Potential Loss of Safety Function Events Associated with Inoperable Single Train Systems Due to Misinterpretation of Reporting Guidance
| ML17220A314 | |
| Person / Time | |
|---|---|
| Site: | Watts Bar  |
| Issue date: | 08/08/2017 |
| From: | Simmons P Tennessee Valley Authority |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| LER 17-007-00 | |
| Download: ML17220A314 (10) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(viii)(B) |
| 3901917007R00 - NRC Website | |
text
Tennessee Valley Authority, Post Office Box 2000, Spring City, Tennessee 37381 August 8, 2017 10 cFR 50.73 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Watts Bar Nuclear Plant, Units 1 and 2 Facility Operating License Nos. NPF-90 and NpF-96 NRC Docket No. 50-390 and 50-391 Subject: Licensee Event Report 39012017-007-00, Multiple Unreported Potential Loss of Safety Function Events Associated with tnoperable Single Train Systems Due to Misinterpretation of Reporting Guidance This submittal provides Licensee Event Report (LER) 39012017-OO7-OO. This LER provides details concerning a failure by Watts Bar personnel to report potential Loss of Safety Function events associated with single train safety systems. This issue, and the related events are being reported in accordance with 10 CFR 50.73(a)(2)(v). A supplement to this LER addressing corrective actions and the engineering evaluation of these events is expected to be submitted by October 10,2017.
There are no regulatory commitments contained in this letter. Please direct any questions concerning this matter to Kim Hulvey, wBN Licensing Manag er, at (423) 36s-7720.
Res ctfull Site Vice President Watts Bar Nuclear Plant Enclosure cc: See Page 2
U.S. Nuclear Regulatory Commission Page 2 August 8, 2017 cc (Enclosure):
NRC Regional Administrator - Region ll NRC Senior Resident lnspector - Watts Bar Nuclear Plant
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION (04-2017)
- o"t'.r*
LICENSEE EVENT REPORT (LER)
APPROVED BY OMB: NO.3150-0104 exmzo Estimated burden per response to comply with this mandatory collection request: 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />.
Reported lessons learned are incorporated into the licensing process and fed back to industry, Send comments regarding burden estimate to the lnformation Services Branch (T-2 F43), U.S Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to lnfocollects.
Resource@nrc.gov, and to the Desk Officer, ffice of lnformation and Regulatory Afiairs, NE0B-10202, (315G0104), ffice of Management and Budget, Washington, DC 20503, lf a means used to impose an information collection does not display a cunently vatiO Otytg control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 1. FACILITY NAME Watts Bar Nuclear Plant, Unit 1
- 2. DOCKET NUMBER 05000390
- 3. PAGE 10F8
- 4. TITLE Multiple Unreported Misinterpretation of Potential Loss of Safety Function Reporting Guidance Events Associated with lnoperable Single Train Systems Due to
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED MONTHI Ony I yEnn YEAR I t:,.['^FJLT' REV NO.
MONTH DAY YEAR tii:ii] ff Nuctear ptant, Unit 2 ffi 06 09 l 2017 2017 007 00 08 08 2017 FACILITY NAME MBER
- 9. OPERATING MODE 1 1 ' THIS REPORT lS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR g: (Check all tnat apptq) 1 tr zo 22o1(b) tr 20 z2o3(a)(3Xi) tr 50.73(a)(2XiiXA) tr 50.73(aX2XviiiXA) n 20 2201 (d)
I za.22o3(a)(3)(i.)
tr 50 73(aX2)(i.XB) tr 50.73(a)(2)(viii)(B) n 20 2203(aX1) tr 20 zzo3(a)(4) tr 50 73(ax2xiir) tr 50 73(a)(2)(ix)(A) tr zo 22o3(a)(2)(i)
X 50 36(cX1)(iXA) tr 50 73(aX2Xiv)(A) n so 73(aX2Xx) 10, POWER LEVEL 76 tr 20 2203(a)(2)(ii) tr 50 36(c)(lXiiXA) n 50.73(aX2Xv)(A) tl rc T1(ax4) tr zo z2o3(aX2xiii)
I 50 36(c)(2)
X 50 73(aX2)(vXB) tr rc 71 (axs) tr 20 2203(a)(2Xiv) tr 50 46(a)(3xii)
X 50 73(a)(2)(v)(c) tr ftrr(a)(1) tr 20 2203(a)(2)(v) tl 50 73(ax2)(ixA)
X 50 73(aX2)(vXD) n B r7(a)(2xi) tr zo 22o3(aX2)(vi)
X 50 73(aX2Xi)(B) t] 50 73(a)(2xvii) n fi tr(ax2xii) tr 50 73(aX2)(iXC) fl OTHER Specify in Abstract below or in 1il.
E. Other Systems or Secondary Functions Affected
No other systems or secondary functions were affected.
F. Method of discovery of each Component or System Failure or Procedural Error
The failure to report these potential loss of safety function events was discovered during an on-going evaluation of this issue by WBN licensing personnel with assistance from othjr offsite licensing personnelwho had been involved in the development of NUREG-1022 Revision 3.
G. Failure Mode and Effect of Each Failed Component lndividual failures for each event are summarized in section Vlll.
H. Operator Actions
No operator actions were required at the time, as there were no on-going events.
l. Automatically and Manually lnitiated Safety System Responses Not applicable.
CAUSE OF THE EVENT
A. The cause of each component or system failure or personnel error, if known.
The cause of the failure to report was an incorrect understanding of the regulation associated with events or conditions that could have prevented fulfillment of a safety function.
B. The cause(s) and circumstances for each human performance related root cause.
The cause of the failure to report was an incorrect understanding of the regutation associated with events or conditions that could have prevented fulfillment of a safety function in addition to the individual human performance and equipment failures attributed to Lach event.
ANALYSIS OF THE EVENT
When events occurred that resulted in single train systems not meeting TS LCO requirements; the short duration of these events relative to their required action completion timL were not considered a loss of s1f9tY function by Operations and Licensing personnel. During evaluation of this issue, with input from offsite sources, WBN licenslg personnel became aware of a 6tter transmitted by the Nuclear itegulatory Co-mmission (NRC) staff tg Exelon Corporation in January 2015 that provides an NRC position on-loss oi safety function related to single train type systems. This iesulted in a reassessment of those events that s!9910 have been reported as a potential loss of safety function, considering the guidance of NUREG-1022 that a report is required when:
tv.
"1) there is a determination that the SSC is inoperable in a required mode or other specified condition in the TS Applicability,
- 2) the inoperability is due to one or more personnelerrors, including procedure violations; equipment failures; inadequate maintenance; or design, analysis, fabrication, equipment qualification, construction, or procedural deficiencies, and
- 3) no redundant equipment in the same system was operable."
Reassessment using these criteria identified a number of events related to single train systems. WBN had not reported events related to Refueling Water Storage Tank (RWST) {ElIS:TK} level, shield building
{EllS:NH} pressure being outside TS limits, containment pressure being outside TS limits, and the control room envelope {EllS:NA} being inoperable due to a boundary door {EIIS:DR} inadvertently left open. Each event is described in Section Vlll of this report. WBN's initial assessment of the safety impacts of these events is provided below. A supplement to this LER is planned to address the results of WBN's final evaluation.
- 1. With respect to RWST level, three events occurred where the RWST level went below the TS 3.5.4 allowed value. While the level was below that permitted by the TS, the level reduction was very small with respect to the tank volume. The safety function capability of the tank is expected to have been met for design basis events (DBEs).
- 2. The WBN containment design includes a free standing steel pressure vessel surrounded by a reinforced concrete shield building. The shield building is maintained at a negative pressure during normal operation by non-safety related ventilation systems required to be in operation in Modes 1 -4. ln the event of an accident, safety related ventilation systems would filter the exhaust from the shield building, reducing the offsite dose to members of the public from postulated leakage of the containment pressure vessel. On multiple occasions, the pressure in the shield building went outside of TS 3.6.15 allowable limits as a result of equipment failures. While these events represent a potential loss of safety function, evaluation of these events shows that the safety function capability of the shield building, the containment pressure vessel, and the associated ventilation systems would not have been lost. The Emergency Gas Treatment System (EGTS), which would function to filter the exhaust from the shield building, is capable of performing its safety function assuming the shield building is not at a negative pressure. ln addition, such testing or equipment malfunctions also has impacted containment pressure TS 3.6.4 which specifies the relative pressure limits between the containment and the annulus. The design of the containment pressure vessel bounds any minor pressure transient that may occur during ventilation system transients and its safety function capability would not be lost.
- 3. The control room envelope (CRE) is required to be operable in Modes 1 through 6. Operability requires integrity of the control room envelope such that it will have a low unfiltered inleakage during accident conditions to maintain the dose to operators within the requirements of 10 CFR 50, General Design Criterion 19. TS allows the CRE boundary to be opened intermittently under administrative control, normally to allow personnel ingress and egress from the control room. Administrative controls in the case of boundary doors are that an individual is in control of the door when it is opened. On multiple occasions, personnel entering and leaving the control room left one of the boundary doors open. This resulted in operations personnel entering TS LCO 3.7.10, Control Room Emergency Ventilation System (CREVS),
Condition B for one or more CREVS trains inoperable due to an inoperable CRE boundary. Low positive pressure (less than 0.2 inches of water gauge (WG)) in the control room for g0 seconds results in a control room alarm. Upon receipt of the alarm, operations personnel promptly closed the CRE door. For these events, the time that the CRE boundary was open was approximately four minutes for each event.
including the alarm delay time. The licensing basis at WBN for a loss of coolant accident assumes instantaneous core damage and release, and therefore, a potential loss of safety function event for each case occurred. The physics of such an event are that core damage and a containment release would take some period of time much greater than a few minutes. The CRE door would be expected to be closed with high confidence well in advance of an actual radiological release. Most of the door events involved the door being ajar, and under these circumstiances simplified, non-surveillance testing has shown that a positive control room pressure would be present.
V. ASSESSMENT OF SAFETY CONSEQUENCES
The failure to report potential loss of safety function events represents a significant concern from a regulatory standpoint. A currently on-going review of these events indicate, when considering the actual system capability and the response of equipment and personnel, a loss of safety function capability impacting public health and safety did not occur. A supplement to this LER is planned to address the results of WBN's finalevaluation.
A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event These events are currently under review.
B. For events that occurred when the reactor was shut down, availability of systems or components needed to shutdown the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident These events are currently under review.
C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from the discovery of the failure until the train was returned to service These events are currently under review. The time period that systems and equipment were outside of specified TS limits is described in Section Vlll of this LER.
VI. CORRECTIVE ACTIONS
This event was entered into the Tennessee Valley Authority (T\\/A) Corrective Action Program and is being tracked under Condition Report (CR) 1310096.
A. lmmediate Corrective Actions Upon determining that previous events were reportable, this LER was initiated and developed for submittal. Communication of this reporting issue has occurred within operations and licensing.
B. Corrective Actions to Prevent Recurrence or to Reduce Probability of Similar Events Occuning in the Future WBN is in the process of determining appropriate corrective actions to reduce recurrence of these events. A supplement to this LER is planned to address additional corrective actions.
vil.
VIII.
PREVIOUS SIMILAR EVENTS AT THE SAME SITE
On November 11,20'15, WBN Unit 1 failed to enter TS 3.1.8 Condition A which was required when WBN Unit 1 experienced a rod drop event. This was subsequently reported to the NRC as a condition prohibited by TS in LER 390-2016-007 on June 20,2016. This event is similar in that licensing personnel incorrectly interpreted requirements related to how to comply with TS 3.1.8.
POTENTIAL LOSS OF SAFEW FUNCTION EVENTS FOR PREVIOUS THREE YEARS A summary of potential loss of safety function events over the last three years is provided below:
Events related to TS LCO 3.5.4 for the Refueling Water Storage Tank less than 370,000 gallons Events related to TS LCO 3.6.4 for Containment Pressure outside range of greater than of equal to -0.1 psid and less than or equal to +0.3 psid relative to the annulus Events related to TS LCO 3.6.15 Condition B for annulus pressure requirement not met for the Shield Building. SR 3.6.15.1 requires annulus to be greater than -5 inches WG with respect to atmosphere Date Time Condition Report Summary 3t24t14 0435 864251 Entry into TS LCO 3.5.4.8 when level in the RWST went below TS minimum of 370,000 gallons with Unit 1 in Mode 4. Exited LCO when Unit 1 entered Mode 5 at 0620 on March 24,2014. Due to other equipment issues, a decision was made to use the RWST to provide a Reactor Coolant System (RCS) makeup water source durinq cooldown.
717 t14 1255 907544 Entry into TS LCO 3.5.4.8 when level in the RWST went betow TS minimum of 370,000 gallons. A leak from the suction side of the Refueling Water Purification Pumps was isolated and the Unit 1 RWST was refilled.
The LCO condition was exited on July 7,2014 at 1320.
6t5t16 1230 1317307 Entry into TS LCO 3.5.4 Condition B when level in the RWST went betow TS minimum of 370,000 gallons due to a reactor trip with safety injection (SI) on WBN Unit 2. Exited TS LCO 3.5.4 Condition B on June 5, 2016 at 1622 when the RWST was above TS minimum level. The trip with Sl was reported to the NRC in LER-391-2016-004 on Auqust 4.2016.
Date Time Condition Report Summary 7114t16 1307 1317307 Entry into TS LCO 3.6.4 condition A when the containment pressure was less than -0.1 psid relative to the annulus following the loss of power to the annulus vacuum fans. TS LCO 3.6.4 Condition A was exited on July 14, 2016 at'1354.
3t13t17 1 558 1273873 Entry into TS LCO 3.6.4 condition A when the containment pressure was Iess than -0.1 psid relative to the annulus during Auxiliary Building Gas Treatment System (ABGTS) Pressure Test of Train B. TS LCO 3.6.4 Condition A was exited On March 13,2017 at 1613.
Date Time Condition Report Summary 3t12t15 1 133 998890 Entry into TS 3.6.15 Condition B for annulus pressure not within limits (more negative than -5 inches WG) due to dropping below -5.5 inches WG because 1-FCO-65-49 Annulus Vacuum normal control damper not controlling properly. Annulus pressure restored at 1305.
9t13t15 1025 1317307 Entry into TS 3.6.15 Condition B for annulus pressure not within limits due to pressure transient from initiating an Auxiliary Building lsolation (ABl) for U2 testing. LCO 3.6.15 was exited at 1031.
6t2t16 1512 1177619 Entry into TS 3.6.15 Condition B for annulus pressure not within limits due to failure of 2-FCO5-45 to open during 2-Sl-99-303-B. Exited LCO 3.6.15 at 1518.
6t5t16 1240 1317307 Shield building pressure less than -5 in WG due to U2 Reactor Trip with Sl. Exited condition at 1242 on June 5,2016. The trip with Sl was reported to the NRC in LER-391-2016-004 on August 4,2016.
7 t14t16 1 303 1 31 7307 Shield building pressure less than -5 in WG due to Loss of Power Power Ascension Test (PAT). TS LCO 3.6.15 Condition B not entered into plant logs. Exited condition at 1438 on July 14,2016 when annulus pressure was greater than -5 in WG.
3t1t17 1445 1 31 7307 Entry into TS LCO 3.6.15 Condition A and B for annulus not more negative than -5 inches WG due to transient caused by storm front moving through area. Exited TS LCO 3.6.15 Condition A and B on March 1,2017 at'1446.
3t13t17 1 558 1272164t 1272224 Shield building pressure Iess than entry into LCO 3.6.15 Condition B March 13.2017.
- - 5 in WG due to ABGTS testing (No logged). Exited condition at 1812 on Events related to TS LCO 3.7.10 for the Control Room Emergency Ventilation System (CRE boundary breached)
Note: The control room pressure alarm comes in after a 90 second delay.
Date Time (Alarm)
Condition Report Summary 3t23t14 0424 862708 Boundary door closed bv 0427 3t30t14 0951 866226 Boundary door closed by 0953 5131t14 0157 894 134 Boundary door closed by 0159 6t14t14 091 5 899633 Boundary door closed by 0917 6123114 1 135 903067 Boundary door c osed by 1 140 7 t10t14 1255 909000 Boundary door c osed by 1257 7 t11114 1014 91 0 194 Boundary door c osed by1016 7 t19t14 0822 912154 Boundary door c osed by 0823 8t22t14 1740 1317307 Boundary door closed by 1743 8t23t14 2240 1317307 Boundary door closed bv 2246 10t21114 0708 948571 Boundary door closed by 0710 11t7t14 1722 1317307 Boundary door closed by 1725
IX. ADDITIONAL INFORMATION None.
X.
COMMITMENTS
None.
Date Time (Alarm)
Condition Report Summary 12t15t14 1245 967964 Boundary door closed by 1247 1t18t15 0703 979264 Egqndary door closed by 0705 213t15 1 305 985860 Boundary door closed by 1306 2t8t15 0726 986637 Boundary door closed by 0727 2t11t15 0603 988464 Boundary door closed by 0605 3115t15 1242 1 00041 3 Boundary door closed by 1244 3125t15 1924 1317307 Boundary door closed by 1925 6t15t15 1502 1 040054 Boundary door closed pl'-r 504 7 t21t15 1918 1 31 7307 Boundary door closed by 1922 7t22t15 2100 1061510 Boundary door closed by 2103 8t18t15 0427 107 1973 Boundary door closed by 0429 10t13t15 0751 1092726 EqUdary door closed by 0753 10t31t15 0240 1 099526 Egqlldary door closed by 0242 10t31t15 1 358 1 099592 Eoundary door closed by1360 11t14t15 0728 1 1 04089 Boundary door clgsed by 0731 1215t15 2207 1112234 Boundary door closed by 2210 1t4t16 1 053 1121123 Boundarv door qlosed by 1055 1t22t16 0332 1127775 Boundary door qlosed by 0334 1t22t16 2247 1128181 Boundary door closed by 2250 1t26t16 0550 1129073 Boundary door closed by 0552 1t26t16 2005 1129477 Boundary dgor closed by 2007 2t15t16 1102 1137634 Boundary door closed by 1 104 4t20t16 1827 1162773 Boundary door closed by 1830 4127 t16 2334 1317307 Boundary door closed by 2337 5t12t16 2134 1170567 Boundary door closed by 2141 6t29t16 1 951 1187273 Boundary door closed by 1954 7 t30t16 0404 1197627 Boundary door closed by 0406 10t21t16 1409 1225143 Boundary door closed by 1 412 3t20t17 0120 1274363 Boundary door closed by 0122 3t21t17 0900 1275203 Boundary door closed by 0902. The Control room door was undergoing minor maintenance. Maintenance personnel were in control o[!he door during this activity.
416t17 1620 1281767 Boundary door closed by 1623 5113t17 1408 1295376 Boundary door closed by 1 410Page 8 of 8