IR 05000289/2012005
| ML13094A219 | |
| Person / Time | |
|---|---|
| Site: | Three Mile Island  |
| Issue date: | 04/04/2013 |
| From: | Darrell Roberts Division Reactor Projects I |
| To: | Pacilio M Exelon Generation Co, Exelon Nuclear |
| HUNEGS, GK | |
| References | |
| EA-13-046 IR-12-005 | |
| Download: ML13094A219 (9) | |
Text
UNITED STATES ril 4, 2013
SUBJECT:
THREE MILE ISLAND NUCLEAR STATION, UNIT 1 - PRELIMINARY WHITE FINDING (NRC Inspection Report No. 05000289/2012005)
Dear Mr. Pacilio:
On February 11, 2013, the U.S Nuclear Regulatory Commission (NRC) issued Inspection Report 050000289/2012005. This report documented a finding with an apparent violation associated with the Three Mile Island (TMI) external flood barrier system (AV 05000289/2012005-03). Specifically, the finding, which was discussed at an exit meeting on January 25, 2013, involved electrical cable conduit couplings that were not flood sealed in the Air Intake Tunnel (AIT), as designed, to maintain the integrity of the external flood barrier.
The subject inspection report also indicated that the significance of the finding was still under evaluation by the NRC and was to be determined (TBD).
We have completed our evaluation of the significance of this finding using the NRC Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). This finding has preliminarily been determined to be a White finding with low to moderate significance that may require additional NRC inspection. The preliminary significance (White) was based on the degradation of the external flood barrier system designed to mitigate a flooding initiating event.
Specifically, during a probable maximum flood (PMF), the electrical cable conduit couplings that were not flood sealed in the AIT would have an adverse flooding impact on safety related equipment and various emergency core cooling systems. A copy of our risk significance determination is enclosed.
The finding is an apparent violation of NRC requirements set forth in 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, because you failed to promptly identify and correct, during external flood barrier walkdowns, that electrical cable conduit couplings in the AIT were not sealed, as designed, to maintain the integrity of the external flood barrier system. This violation is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy, which can be found on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.
We believe that we have sufficient information to make a final significance determination.
However, before we make a final decision on this matter, we are providing you with an opportunity to: (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2)
submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of IMC 0609.
Please contact Gordon Hunegs at (610) 337-5046 within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will issue our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence. Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time.
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be made available electronically for public inspection in the NRC Public Document Room or from the NRCs document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html.
Sincerely,
/RA/
Darrell J. Roberts, Director Division of Reactor Projects Docket No. 50-289 License No. DPR-50 Enclosure: Risk Significance Determination cc: Distribution via ListServ
ML13094A219 Non-Sensitive Publicly Available SUNSI Review Sensitive Non-Publicly Available OFFICE RI/DRP RI/DRP RI/DRS RI/ORA RI/DRP NAME mmt BBickett/ BB GHunegs/ GKH CCahill/ CGC DHolody/ DH DRoberts/DJR DATE 04/ 02 /13 04/ 02/13 04/ 02/13 04/02 /13 04/04/13 Distribution w/encl:
W. Dean, RA D. Lew, DRA D. Roberts, DRP M. Layton, DRP C. Miller, DRP J. Clifford, DRP G. Hunegs, DRP B. Bickett, DRP D. Werkheiser, DRP, SRI J. Heinly, DRP, RI J. Cassidy, RI OEDO RidsNrrPMThreeMileIsland Resource RidsNrrDorlLpl1-2 Resource ROPReports Resource D. Holody, ORA M. McLaughlin, ORA C. Crisden, ORA N. Coleman, OE M. Halter, NRR
Risk Significance Determination The inspectors identified an apparent violation (AV) of 10 CFR 50, Appendix B, Criterion XVI, Corrective Actions, for Exelons failure to promptly identify and correct a condition adverse to quality associated with external flood barrier deficiencies (AV 05000289/2012005-03).
Specifically, Exelon failed to promptly identify and correct electrical cable couplings/conduits that were not flood sealed in the AIT, as designed, to maintain the integrity of the external flood barrier. This condition would have an adverse flooding impact on safety related equipment and various emergency core cooling systems (including the decay heat removal, charging, emergency feedwater systems) through the AIT with an external flood height between 305 and 313.3.
The issue was more than minor because it was associated with the mitigating systems cornerstone attribute of external events and affected the cornerstone objective of ensuring the availability and reliability of systems that respond to initiating events to prevent undesirable consequences.
Phase 1 Screening Logic The analyst evaluated the issue using the Significance Determination Process (SDP) Phase 1 Screening Worksheet for the Initiating Events, Mitigating Systems, and Barriers Cornerstones provided in Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings. This finding affected the Mitigating Systems Cornerstone because flood protection was degraded. The analyst determined that the finding represented degradation of equipment and functions specifically designed to mitigate a flooding initiating event and that during a flooding event the loss would degrade two or more trains of a multi-train safety system. Therefore, the finding was potentially risk significant to flood initiators and a detailed Phase 3 analysis was required.
Phase 3 Evaluation The TMI plant-specific SPAR, Revision 8.19, as modified, was the best tool for quantifying the conditional core damage probabilities of the subject performance deficiency for flood elevations below 313.3 feet mean sea level. A specific Event Tree titled IE-AIT-PMF, Figure 1, was developed to model the condition. Below are the significant assumptions for each top event, references, where appropriate, are provided in the parenthesis:
Top Event EW. Models that the licensee has early warning (EW) of the impending flooding event. Successful implementation of flood procedure depends on the availability of sufficient time to perform the necessary actions. The single basic event mean value, based on a lognormal distribution fit to the lower and upper bounds as the 5th and 95th percentiles is 3.84E-4 (Individual Plant Examination for External Events (IPEEE) 5.2.6).
Top Event CS. This top event represents the successful and timely response of operators to initiate shutdown and bring the plant to cold shutdown (CS) condition. Systems intact include decay heat removal (DHR), emergency feedwater (EFW) and intermediated closed loop cooling.
Note that the success (no core damage) paths require success in both Top Events CS and SL described below. The single basic event mean value for the cases with offsite power available is 9.32E-3 (IPEEE 5.2.6).
Top Event SL. This top event refers to the successful implementation of a series of steps listed in the emergency procedure under emergency closure" category. The single event human basic error assuming the plant is already in cold shutdown at the time the flood peaks equals 5.6E-2 (IPEEE 5.2.6).
Top Event EPS. This top event refers to the ability of the emergency diesel generators (EDG)
to provide power during the event and utilizes the existing SPAR model EDG fault tree. Basic assumptions under this top event include:
1) The plant is predicted to experience a loss of offsite power during postulated flooding at or above 3046 feet mean sea level (MSL) (SDBD-T1-122 Flood Protection System Design Basis Document, section 3.2.1).
2) The Unit 1 SBO diesel is afforded some protection by the Unit 2 Flood Barrier system. It is not credited for mitigation of floods. (SDBD-T1-122 Flood Protection System Design Basis Document, section 3.2.1).
Top Event AIT-Sump. Based on the licensees technical evaluation, for floods that exceed 309 feet MSL, the AIT sump pump (SD-P-7) is required to function to prevent the loss of EFW.
Additionally, if the level in the AIT exceeds the 289 ft elevation, water will enter the auxiliary (Aux) building and fuel handling building (FHB) through the ventilation system ductwork irrespective of the AIT to Aux/FHB fire seals.
In the Base case this top event is assumed to be a success and there would be no substantial flooding from the AIT if the PD did not exist.
No plant specific failure data was available to predict the reliability of the AIT sump pump (SD-P-7). There were no pre-existing procedures that would have made the operators aware of the importance of this pump and the need to repower it from the EDGs. The only information available would be a high AIT sump alarm. Estimated failure rates as high as 2.51E-2/hrs was obtained from ANSI/IEEE Std. 500-1984, Section 11.1.2.3.2, Centrifugal Pumps 500-2499 GPM. Basic assumptions under this top event include:
1) The pump is expected to experience multiple starts 24 hrs before the site loses offsite power (ACIT 1104245-17, section 2.7), as a result the failure to start probability was assumed to be 5E-2.
2) Based on the flood hydrograph provided in the USFAR, it is anticipated that the flooding could exist on the site for 60 hrs. Due to this long mission time a failure probability of 1E-2 was assumed.
3) SD-P-7 is powered from non-vital switchgear and has to be a manually aligned to the to the safety bus. A SPAR-H was performed assigning High to stress for both diagnostic and action. All other values were left at nominal.
Top Event Fire-Seals. This models the ability of the silicone foam fire barriers that separate the AIT from the Aux/FHB to prevent flooding the Aux/FHB and the IB, given the performance deficiency, if the AIT sump pump functions. These seals were not designed or installed as flood barriers. The licensee performed limited testing and developed estimated leak rates for various configurations. These leak rates were utilized by the licensee to determine flood levels within the plant. Given the large number of susceptible seals, the limited testing and inability to directly correlate the tested configuration to the as-installed configuration, the analyst assumed a catastrophic seal failure probability single basic event = 1E-1(90% chance of success).
In the Base case this top event is assumed to be a success as there would be no substantial flooding that would challenge the fire seals if the PD did not exist.
Top Event DHR. This models DHR and its support systems needed to remove decay heat, if the Aux building is not flooded. If the building is flooded, it is assumed that DHR pumps are failed as they are situated in the lowest part of the Auxiliary Building. For all conditional cases evaluated it is assumed that DHR is lost as it is in close proximity to the flooding and situated in the lowest part of the Auxiliary Building. Basic event EFM-XHE-PMF (Establish sump pumps during PMF) was added as a dependency in the DHR fault tree. To mitigate the impact of in-leakage into the independent screen and pump house (ISPH) flood barrier envelope, the licensee credits two portable powered sump pumps. The pumps are powered from Class 1E supplies. Both pumps are required to remove the estimated leakage. In the event one pump fails water level in the ISPH will rise and challenge the cooling water systems.
Top Event EFW. The site has two motor driven EFW pumps and one turbine driven pump (TDP). If normal decay heat removal is lost, the reactor would heat-up and return to steaming from the steam generators requiring the use of EFW. Electrical power is assumed to be required for EFW success. Although in an station blackout (SBO), the TDP would still have the capability to function, the flood far exceeds the battery depletion times.
Flooding in the IB above 296 is assumed to fail EFW.
Top Event SEAL. The possibility of reactor coolant pump (RCP) seal failure was considered, however found to be a small contributor given the lack of data on RCP seal failures resulting from re-pressurization on the loss of heat removal.
Top Event EFM. This event models the use of beyond design basis, pre-staged extensive flood mitigation equipment to supply water to the steam generators for decay heat removal and water to the RCS for coolant inventory control. Temporary power would be supplied by a dedicated portable diesel generator. The secondary-side heat removal is achieved by a submersible pump feeding the steam generators and the steam being released via opening the turbine exhaust hood manways, turbine bypass valves or manual operation of the steam generator safeties. The primary side inventory makeup and seal cooling is achieved by a submersible spent fuel pump feeding through the reactor coolant pump seal lines or by throttling flow from the core flood tanks. Flood procedure failure rate = 2.55 E-1 (IPEEE section 5.2.5).
Recovery. Recovery during the event, with the exception of the extensive flood mitigation equipment, is not credited. The placement of flood control barriers will make areas such as the diesel building and independent screen and pump house virtually inaccessible. Flood levels on the island could reach 8.3 feet, above grade, severely restricting access. Additionally, access to the island during the event will not be possible due to submergence of the access bridges.
Exposure Time. The subject performance deficiency existed for many years. Therefore, in accordance with Manual Chapter 0609, Appendix A, Attachment 1, Usage Rule 1.1, Exposure Time, the analyst determined that the exposure time should be limited to the maximum exposure time of 1 year.
Flood Hazard. Based on recent reanalysis of the flooding risk performed at TMI, the bin values for the expected value, 5th and 95th hazard curves based on the licensees AMEC report were developed for the analysis. Bins 2 and 3 are the bins of interest.
Flood Flood Flood Bin Bin Bin Bin Bin Return Bin Bin Bin Elevation Frequency Frequency Frequency Period Number Lower Upper (feet) 5th Expected 95th Expected Bound Bound (per year) Value (per year) Value (feet) (feet) (per year) (years)
1 300 304 302.5 3.45E-04 8.75E-04 2.36E-03 1,142.7 2 304 309 306.5 1.10E-04 2.84E-04 8.09E-04 3,521.8 3 309 314 311.5 3.00E-05 8.38E-05 2.51E-04 11,939.0 4 315 315 315.0 4.99E-05 7.91E-05 2.29E-04 12,640.2 Safety Concern. This issue does not present an immediate safety concern. Exelon implemented prompt interim compensatory actions to restore operability of the flood barrier.
These actions included staging sand and large earth-moving equipment which would be used to fill the yard cable vaults containing the entrance to the AIT cable conduits and limit flood water leakage in order to maintain the decay heat removal function during a flood. Exelon also installed flood seals upstream of the AIT conduits from the cable vaults in November 2012 to provide a waterproof barrier. Specifically, the unsealed electrical conduits were sealed by the injection of a watertight qualified sealant material into the associated cable conduits from the yard cable vaults. The sealant material, as well as the underground concrete encased conduits, became the credited external flood barrier and met the current licensing basis requirements.
Conclusion - Flooding from 309 to 313 dominated the risk due to the potential to lose EFW.
The dominant sequences were:
1) Flooding with a failure of the AIT fire seals and failure to establish the extensive flood mitigation equipment (IE-PMF-AIT + AIT-FIRE-SEAL + EFM-XHE-SITE)
2) Flooding with a failure of the AIT sump pump and failure to establish the extensive flood mitigation equipment (IE-PMF-AIT + AIT-MDP-FS-SD-P7 + EFM-XHE-SITE)
The resulting CDF is 4.49E-6 which represents a White Condition.
Figure 1 Event Tree