05000410/LER-2005-001

LER-2005-001, Nine Mile Point Unit 2

Nine Mile Point Unit 2
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material
4102005001R01 - NRC Website

I. Description of Event

On March 17, 2005, with Nine Mile Point Unit 2 (NMP2) operating at approximately 100 percent power, Nine Mile Point Nuclear Station, LLC determined that NMP2 had operated in the past with both subsystems of the Standby Gas Treatment (SGT) system simultaneously inoperable, that Technical Specification (TS) Limiting Condition for Operation (LCO) 3.0.3 was not entered as required by Condition D of TS 3.6.4.3, and that the actions prescribed by TS LCO 3.0.3 were not initiated.

On November 14, 2004, a question was raised regarding operability of an SGT subsystem when operated with the filter train recirculation line pressure control valve (2GTS*PV5A, 2GTS*PV5B) in the manual control mode and not fully closed. Such operation was allowed by plant operating procedures for SGT system operation during primary containment inerting, de-inerting, and purging. With the pressure control valve not in the automatic mode of operation, the capability of an SGT subsystem to perform its design basis function of establishing and maintaining a negative pressure in the secondary containment following a design basis accident (DBA) was questioned. The plant operating procedures did not contain any notes or cautions regarding the potential impact on SGT subsystem operability of placing the pressure control valve in manual and did not require that the affected SGT subsystem be declared inoperable.

The safety function of the SGT system is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a DBA are filtered and adsorbed prior to exhausting to the environment. This is accomplished by establishing and maintaining a negative secondary containment pressure of at least 0.25 inches water gauge with respect to the outside atmosphere. The SGT system consists of two fully redundant subsystems, each with its own set of ductwork, dampers, charcoal filter train, and controls. Following initiation, both subsystem fans start and the associated subsystem inlet and fan discharge valves open. Negative pressure in the secondary containment is automatically controlled by the SGT subsystem filter train recirculation line pressure control valves.

The SGT system also provides charcoal filtration of the primary containment atmosphere during inerting, de-inerting, and purging. In this operating mode, the SGT filter train recirculation line pressure control valve must be manually throttled open to balance drywell in-flow and out-flow, to maintain drywell pressure within the desired band and prevent isolations/initiations on high drywell pressure. If a DBA occurred while the SGT subsystem was in this configuration, the pressure control valve would remain in the throttled position, and the net SGT subsystem exhaust rate would be reduced due to flow through the filter train recirculation line. An engineering evaluation concluded that with this reduced net exhaust rate, the SGT subsystem was not capable of automatically performing its design basis secondary containment drawdown function and, therefore, should have been considered inoperable.

A review of SGT system operation during the past three years was subsequently conducted to identify those occasions when an SGT subsystem was operated with the filter train recirculation line pressure control valve in the manual control mode, and to then determine the plant status (operating mode) and configuration of other required systems and components (e.g., the other SGT subsystem, power sources, etc.) during those periods. This review identified the following:

1. On March 15 and 16, 2002, during shutdown for a refueling outage, the Division 2 SGT subsystem was operated with pressure control valve 2GTS*PV5B in manual for primary containment purging and should have been declared inoperable.The Division 1 emergency diesel generator (EDG) was simultaneously inoperable but available (for pre-planned maintenance) for greater than four hours, thereby rendering the Division 1 SGT subsystem inoperable. With both SGT subsystems inoperable, TS LCO 3.0.3 should have been immediately entered in accordance with Condition D of TS 3.6.4.3, "Standby Gas Treatment (SGT) System," and the actions specified in TS LCO 3.0.3 should have been initiated. The Division 1 SGT subsystem was still capable of responding to an accident with offsite power available. In addition, although the Division 1 EDG was declared inoperable, it was available and capable of powering the Division 1 SGT subsystem in the event of an accident with a loss of offsite power.

I. Description of Event (continued) 2. On November 24 and 25, 2002, during startup from a forced outage, the Division 2 SGT subsystem was operated with pressure control valve 2GTS*PV5B in manual for primary containment purging and should have been declared inoperable. The Division 1 emergency diesel generator was simultaneously inoperable and unavailable (for pre­ planned maintenance) for greater than four hours, thereby rendering the Division 1 SGT subsystem inoperable.

With both SGT subsystems inoperable, TS LCO 3.0.3 should have been immediately entered in accordance with Condition D of TS 3.6.4.3, and the actions specified in TS LCO 3.0.3 should have been initiated. The Division 1 SGT subsystem was still capable of responding to an accident with offsite power available. However, for a period of approximately 12.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the Division 1 EDG was not available and would not have been capable of powering the Division 1 SGT subsystem in the event of an accident with a loss of offsite power.

3. On March 15, 2004, during shutdown for a refueling outage, the Division 2 SGT subsystem was operated with pressure control valve 2GTS*PV5B in manual for primary containment purging and should have been declared inoperable. Shortly after entering Mode 2, the Division 1 SGT subsystem was declared inoperable but available (in accordance with plant operating procedures) due to the Division 1 Reactor Building emergency recirculation unit cooler 2HVR*UC413A being declared inoperable and unavailable. Thus, both SGT subsystems were inoperable.

TS LCO 3.0.3 should have been, but was not, entered; however, plant shutdown was already in progress and all of the actions specified in TS LCO 3.0.3 were actually satisfied. Thus, there was no violation of the TS 3.0.3 requirements. The Division 1 SGT subsystem was still capable of responding to an accident, and the Division 2 Reactor Building emergency recirculation unit cooler 2HVR*UC413B remained operable and would have started on a loss of coolant accident (LOCA) signal. In addition, both the Division 1 and Division 2 EDGs were operable.

Further review and evaluation of SGT system operation when aligned for primary containment purging has identified an additional concern. When an SGT subsystem is operated in the primary containment purge mode, the primary containment purge valves are open and the primary containment atmosphere is exhausted through the full-flow 20­ inch line to the SGT system. In the event of a large-break LOCA during primary containment purging, the primary containment purge valves close automatically; however, prior to their full closure, the primary containment pressure transient could damage the SGT subsystem that is aligned for purging, thereby rendering it incapable of performing its intended safety function. The other SGT subsystem is isolated from the purge exhaust flow path by its closed filter train inlet valve to prevent exposure to the LOCA pressure transient. However, further review of the SGT system design has determined that an 8-inch line with two normally open valves (2GTS*AOV28A & B) cross-connects the two SGT subsystems downstream of the filter trains. Thus, the post-LOCA pressure transient could potentially result in the loss of the intended SGT system safety function due to the following:

1. Both SGT subsystems could be damaged by the pressure transient, or 2. With damage to only the SGT subsystem that is aligned for purging, the intact SGT subsystem (now running in response to a LOCA signal) could draw air from the SGT equipment room via the damaged SGT subsystem and the open cross-connect line. The corresponding reduction in the amount of air that would be drawn by the SGT subsystem from the reactor building could adversely impact the ability to establish and maintain a negative

• pressure in the secondary containment post-LOCA.

The review and associated reportability evaluation for the three occurrences involving manual throttling of the SGT filter train recirculation line pressure control.valve were completed on March 17, 2005. The review concluded that there were instances when both SGT subsystems were simultaneously inoperable, and the actions prescribed by TS LCO 3.0.3 were not initiated. The further review and evaluation that were subsequently performed determined that both SGT subsystems were potentially rendered incapable of performing their intended safety function each time one of the SGT subsystems was aligned for primary containment purging. Therefore, the event is reportable in accordance with 10 CFR 50.73(a)(2)(i)(B) and 10 CFR 50.73(a)(2)(v)(C).

II. Cause of Event

The cause of this event as it relates to SGT filter train recirculation line pressure control valve operation was an original design deficiency. When an SGT subsystem is aligned for containment inerting, de-inerting, or purging operations, the SGT filter train recirculation line pressure control valve (2GTS*13V5A/B) must be operated in the manual mode to balance drywell in-flow and out-flow to maintain drywell pressure within the desired band. When operated in this configuration, the SGT subsystem is incapable of automatically performing its design basis secondary containment drawdown function if a DBA occurred since the pressure control valves do not return to the automatic operating mode on an SGT system initiation signal. In addition, the procedures for operating the SGT system during primary containment inerting, de-inerting, and purging permitted placing the SGT pressure control valves in manual without declaring the associated SGT subsystem inoperable and entering TS LCO 3.6.4.3. Personnel involved with development and review of the original operating procedures apparently did not recognize the effect of manual operation of an SGT subsystem's pressure control valve on the capability of the SGT subsystem to perform its safety function. As a result, there were three instances during the last three years when it was not recognized that both SGT subsystems were simultaneously inoperable:

1. March 15 and 16, 2002 (during shutdown for a refueling outage) — Total duration of approximately 27.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />.

2. November 24 and 25, 2002 (during startup from a forced outage) — Total duration of approximately 16.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />.

3. March 15, 2004 (during shutdown for a refueling outage) — Total duration of approximately 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />.

For the additional concern regarding purging operations with an open 8-inch line cross-connecting the two SGT subsystems, the procedures for operating the SGT system during primary containment inerting, de-inerting, and purging did not require that the cross-connect line be isolated. Personnel involved with development and review of the original operating procedures apparently did not recognize that allowing the cross-connect line to remain open could potentially impact the ability of both SGT subsystems to perform their intended safety functions.

Ill. Analysis of Event This event is reportable in accordance with 10 CFR 50.73(a)(2)(i)(B), "Any operation or condition which was prohibited by the plant's Technical Specifications." The SGT system is required to be operable during power operation. As noted above, both SGT subsystems were inoperable on three occasions. For two of those occasions (March 15 and 16, 2002 and November 24 and 25, 2002), TS LCO 3.0.3 was not entered and the actions prescribed by TS LCO 3.0.3 were not initiated. For the March 15, 2004 occurrence, although TS 3.0.3 was not entered, plant shutdown was already in progress and all of the actions specified in TS LCO 3.0.3 were actually satisfied; thus, there was no actual violation of the TS LCO 3.0.3 requirements.

Additionally, this event is reportable in accordance with 10 CFR 50.73(a)(2)(v), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (C) Control the release of radioactive material." There were three occasions relating to SGT filter train recirculation line pressure control valve operation when both SGT subsystems were simultaneously inoperable. In addition, the review and evaluation performed subsequent to submittal of the original LER determined that both SGT subsystems were potentially rendered incapable of performing their intended safety function each time one of the SGT subsystems was aligned for primary containment purging due to the open cross-connect line.

Ill. Analysis of Event (continued) There were no actual consequences of this event since no design basis accidents occurred and neither SGT subsystem was required to actuate during the time periods when both SGT subsystems were inoperable.

The current design basis accident radiological consequence analyses assume that a negative secondary containment pressure of at least 0.25 inches water gauge with respect to the outside atmosphere is established at 60 minutes following event initiation. During this 60-minute period, primary containment leakage and engineered safety feature system leakage are assumed to be released from the secondary containment to the environment at ground level.

Thereafter, the secondary containment atmosphere is processed through the SGT system charcoal filters and released to the environment via the main stack.

For a postulated DBA with both SGT subsystems initially inoperable or with a loss of the SGT system safety function as a consequence of the accident, negative secondary containment pressure would not be established or maintained in accordance with the radiological consequence analyses design basis assumptions, thereby creating the possibility of an additional period of unfiltered ground-level release of radioactive materials to the environment. This could increase the post-LOCA radiological dose consequences both offsite and in the control room. However, the postulated event is of very low probability because it requires that the following conditions occur concurrently:

• Containment inerting, de-inerting, or purging through the full-flow line must be in progress. This typically occurs only during plant startup or shutdown evolutions.

• A large break LOCA must occur. A large break will cause a primary containment pressure transient potentially allowing high pressures to reach the SGT system prior to closure of the containment purge isolation valves.

A probabilistic risk assessment evaluation has been performed for this event. The evaluation determined that the function of the SGT system to establish and maintain negative pressure in the secondary containment is a relatively minor contributor to secondary containment effectiveness and is of low safety significance. Defeating the automatic mode of the SGT subsystem filter train recirculation line pressure control valves by placing them in the manual control mode, and purging with the SGT subsystem cross-connect line open, would not result in an increase in the baseline Core Damage Frequency or Large Early Release Frequency.

Based on the above, the event did not pose a threat to the health and safety of the public or plant personnel.

IV. Corrective Actions

The operating procedures for primary containment inerting, de-inerting, and purging and for the SGT system have been revised to assure that SGT system operability requirements are properly applied during primary containment inerting, de-inerting, and purging evolutions, as follows:

1. Clearly indicate that when an SGT subsystem is operated with the filter train recirculation line pressure control valve in the manual control mode, the subsystem will be declared inoperable and the associated TS LCO will be entered.

2. Require that at least one of the cross-connect line valves (2GTS*AOV28A or B) is verified closed to assure that one SGT subsystem remains available to perform the intended SGT system safety function in the event that a LOCA occurs while inerting, de-inerting, or purging via the full-flow line.

IV. Corrective Actions (continued) An extent of condition review of selected operating procedures and their associated safety related systems has been completed to determine if there are any other instances where existing procedures contain direction which involves an action that inhibits the ability of a safety-related system to automatically align to perform its design safety-related functions (when called upon to do so) from an alignment for non-safety-related or off-normal functions. No other instances of the type identified for the SGT system were discovered.

A. Failed Components:

None

B. Previous similar events:

SGT system to perform its design function without manual operator action. The deficiency involved initiation circuitry for unit coolers that remove heat from the secondary containment following a DBA and did not affect the actual design or operation of SGT system equipment. Thus, the corrective actions would not have prevented the event described in this LER.

C. Identification of components referred to in this Licensee Event Report:

Components� IEEE 805 System ID�IEEE 803.1 Function Standby Gas Treatment System� BH� None Pressure Control Valve� BH� PCV Secondary Containment (Reactor Building)� NG� None Primary Containment� .�NH� None Control Room� NA� None Valve� BH� V