05000423/LER-2007-004
| Millstone Power Station - | |
| Event date: | 10-05-2007 |
|---|---|
| Report date: | 12-3-2007 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 4232007004R00 - NRC Website | |
1. Event Description:
On October 5, 2007 at 1300 while operating at 100% power, Millstone Power Station Unit 3 (MPS3) identified a vulnerability in the fire safe shutdown strategy in which a fire in the control room, instrument rack room or cable spreading area (fire areas CB-8, 9, 11) could disable both the train A and train B charging pumps [CB] [P]. On October 11, 2007, while evaluating the extent of condition for this fire scenario vulnerability, additional fire areas were identified that could disable both the train A and train B charging pumps (fire areas CB-1, CB-2, SE-2, SB-3, AB-5, AB-6). Each of the fire areas contains electrical cables associated with the volume control tank (VCT) [TK] outlet valve and the charging system in the same train. During normal operation, one charging pump train is in service with its suction aligned to the VCT through train A and train B outlet valves in series. In the event of a fire in one of these areas with the opposite train charging pump in service, a fire induced circuit failure could produce spurious closure of the VCT outlet valve, resulting in damage to the operating charging pump. As a result, neither charging pump would be available to provide reactor coolant system inventory control and reactor coolant pump seal injection.
MPS3 has a third charging pump (swing pump) that can be aligned to either train A or train B. If the swing pump were in service for either the train A or train B charging pump, the evaluation described above remains the same.
The fire areas are:
CB-1: Control Building Elevation 4'6" West Switchgear Area CB-2: Control Building Elevation 4'6" East Switchgear Area CB-8: Control Building Cable Spreading Area CB-9: Control Room CB 11: Instrument Rack Room and Under-floor Areas AB-5: Auxiliary Building East MCC/Rod Control Area AB-6: Auxiliary Building West MCC/Rod Control / Air Conditioning Unit Area SB-2: Service Building North Tunnel SB-3: Service Building South Tunnel This condition is being reported under 10CFR50.73(a)(2)(ii)(B), "Any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.
2. Cause:
The apparent cause of this condition is a deficiency in the original fire protection evaluations to meet the requirements of Branch Technical Position (BTP) CMEB9.5-1 (NUREG-0800) as documented in the Millstone Unit 3 Fire Protection Evaluation Shutdown System Availability Report of 1985 (BTP Compliance Report). The BTP Compliance Report did not correctly evaluate the consequential failure of the charging pump(s) resulting from the spurious closure of the VCT outlet valves. The reason for this condition is indeterminate since this is a historical condition that dates back to the initial fire protection evaluations.
3. Assessment of Safety Consequences:
This adverse condition has had no actual safety consequences, as no fire has occurred to challenge the circuits in question. This event involves a postulated fire scenario and subsequent potential failure. Consequently, this condition had no direct impact on the health and safety of the public or plant personnel. The event does involve an unanalyzed condition related to safe shutdown capability and operation.
MPS3 Operating License Condition 2.H invokes the Fire Protection requirements and stipulates that MPS3 shall implement and maintain in effect all provisions of the approved fire protection program as described in the FSAR and as approved in the SER (NUREG-1031). The licensing basis of the fire protection program is to achieve and maintain safe shutdown in the event of a fire.
Per the MPS3 SER Section 9.5.1, the MPS3 fire protection program has been reviewed to the requirements of SRP Section 9.5-1 (NUREG-0800) which contains, in BTP CMEB 9.5-1, the technical requirements of Appendix A to BTP APCSB 9.5-1 and Appendix R to 10CFR50.
BTP CMEB 9.5-1 (Guidelines for Fire Protection for Nuclear Power Plants) Section C.5.b. Safe Shutdown Capability states: (1) Fire protection features should be provided for structures, systems, and components important to safe shutdown. These features should be capable of limiting fire damage so that:
(a) One train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage; and (b) Systems necessary to achieve and maintain cold shutdown from either the control room or emergency control station(s) can be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
The above requirements are captured in the Millstone Fire Protection Program Description MP-24-FPP-PRG and in the MP3 BTP 9.5-1 Compliance Report.
The MPS3 fire protection program is built upon a defense in depth philosophy in which design features and administrative controls reduce the chances of fires occurring, rapidly detect fires that do occur and extinguish fires in their incipient stages. This defense in depth philosophy significantly reduces the possibility of a large scale fire that could result in extensive damage.
As a consequence of the insufficient evaluation of the consequential failure of the charging pumps for the postulated scenario, the MP3 BTP 9.5-1 Compliance Report did not identify, evaluate, or credit specific station procedures that could be used to mitigate the condition. MPS3 uses an Emergency Operating Procedure network that is symptom based and provides direction to the plant operators in the response to plant conditions that could exist as a result of numerous combinations of events or conditions. There is reasonable assurance that the operator response to the postulated scenario would successfully mitigate the postulated scenario using the Emergency Operating Procedure network (e.g., a fire of sufficient magnitude to result in a necessary plant trip would result in entry to the EOP network and would, if conditions warranted, result in depressurizing the plant below high head safety injection limits and utilizing high head safety injection to achieve and maintain safe shutdown).
Specifically, in the event of a large scale fire in one of the fires areas CB-1, CB-2, CB-8, CB-9, CB-11, SB-2, SB-3, AB 5 or AB-6 with the opposite train charging pump in service, a fire induced circuit failure could produce spurious closure of the VCT outlet valve, resulting in damage to the operating charging pump. Although the use of the third charging pump has not been previously analyzed in the fire protection program, with the exception of fire area AB-6, the third charging pump may be available to the operators.
- In the event of a fire in fire areas CB-1, CB-2, SB-2, SB-3, AB-5, the operators remain in the control room and the third charging pump may be available to the operators. Although not previously analyzed, safe shutdown could be achieved either through the use of the third charging pump or by depressurizing the plant below high head safety injection limits and utilizing high head safety injection to achieve and maintain safe shutdown.
- In the event of a significant fire in one of the fire areas CB-8, CB-9 or CB-11, operators would assess the need to evacuate the control room and transfer control to the auxiliary shutdown panel. Although not previously analyzed, safe shutdown could be achieved through the use of the third charging pump.
- In the event of a large scale fire in fire area AB-6, the third charging pump would not be available. However, operators remain in the control room for a fire in fire area AB-6. Although not previously analyzed, safe shutdown could be achieved without relying on the charging system by depressurizing the plant below high head safety injection limits and utilizing high head safety injection to achieve and maintain safe shutdown.
4. Corrective Actions:
Compensatory actions were implemented that enhance the defense in depth philosophy to prevent, detect and rapidly extinguish fires to minimize the likelihood of a large scale fire in these areas. These include additional controls of combustible materials, hourly fire watches and increased monitoring of fire detection and suppression systems for the affected fire areas. Additional administrative controls have been implemented to maximize the availability of the third charging pump in the event of a fire.
An extent of condition review was conducted for the circuit routing for the VCT outlet valves and charging pump suction valves. No other similar conditions were found.
Corrective actions for this condition are being addressed in accordance with the station's corrective action program.
Compensatory actions will remain in place until a permanent resolution is identified and implemented.
5. Previous Occurrences:
No previous similar events/conditions were identified.
Energy Industry Identification System (EIIS) codes are identified in the text as [XX].