ML020910435

LER 98-001-01 for Indian Point Unit 3 Re Potential Failure or Inadvertent Operation of Fire Protection Systems, Caused by Personnel Error in Design

ML020910435
Person / Time
Site:	Indian Point
Issue date:	03/19/2002
From:	Barrett R Entergy Nuclear Northeast
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
IPN-02-017 LER 98-001-01
Download: ML020910435 (8)

Text

Entergy Nuclear Northeast Entergy Nuclear Operations, Inc.

Indian Point Energy Center IEn tergy P.O. Box 308 Buchanan, NY 10511 Tel 914 736 8001 Fax 914 736 8012 Robert J. Barrett Vice President, Operations Indian Point 3 March 19, 2002 IPN-02-017 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Stop O-P1-17 Washington, D.C. 20555-0001

SUBJECT:

Indian Point 3 Nuclear Power Plant Docket No. 50-286 License No. DPR-64 Licensee Event Report # 98-001-01 Potential Failure or Inadvertent Operation of Fire Protection Systems, Caused by Personnel Error In Design, Could Cause a Loss of Cable Spreading Room Cooling Placing the Plant Outside Design Basis

Dear Sir:

The attached revision to Licensee Event Report (LER)98-001 is submitted to complete the assessment of safety significance. The LER has also been editorially revised (e.g., revised to indicate that corrective actions are complete). A bar in the margin indicates changes.

There are no new commitments made in this submittal.

Very tr I5

. - Robe lJ.a et

- ic V resident, Operations In ian Point 3 Nuclear Power Plant cc: See next page

Docket No. 50-286 IPN-02-017 Page 2 of 2 cc: Mr. Hubert J. Miller Regional Administrator Region I U. S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, Pennsylvania 19406-1415 INPO Record Center 700 Galleria Parkway Atlanta, Georgia 30339-5957 U.S. Nuclear Regulatory Commission Resident Inspectors' Office Indian Point 3 Nuclear Power Plant P.O. Box 337 Buchanan, NY 10511 Mr. Paul Eddy NYS Department of Public Service 3 Empire Plaza Albany, NY 12223

NRC FORM 366 U.S. NUCLEAR REGULATORY APPROVED BY OMB NO. 3150-0104 EXPIRES 6-30-2001 (1-2001) COMMISSION Estimated burden per response to comply with this mandatory information collection request: 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />. Reported lessons learned are incorporated into the licensing process and fed back to industry. Send comments regarding burden estimate to the Records LICENSEEc EVENIT REPORT (lE eManagement Branch (T-6 E6), U.S. Nuclear Regulatory Commission, Washington, DC LICENSEE-_w EVENT l REPORT \ } 20555-0001, or by internet e-mail to bis1Qnrc.9ov, and to the Desk Officer, Office of (Sereverse for required number of Information and Regulatory Affairs, NE OB-1 0202 (3150-0104), Office of Management and (See haraoters r each block) Budget, Washington, DC 2050 Ifa means used to impose information collection does not display a currently valid 0MB control number, the NRC may not conduct or sponsor,

nn A n~renn i. nnt rmn ,irPd In racnnnrl ta tha infnrmnfinn rnilprtinn FACILITY NAME (1 DOCKET NUMBER f2l PAGE (31 Indian Point 3 05000 286 OF

_ _ __ _ __ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _6 Potential Failure or Inadvertent Operation of Fire Protection Systems, Caused by Personnel Error In Design, Could Cause a Loss of Cable Spreading Room Coolina. Placina the Plant Outside Desian Basis EVENT DATE (5) LER NUMBER (6) REPORT DATE (7) OTHER FACILITIES INVOLVED (8)

YEAR SEQUENTIAL FACILITY NAME DOCKET NUMBER NUMBER REV MO DAY YEAR NO MO DAY YEAR 05000 FACILIT Y NAME DOCKET NUMBER 02 25 98 98 01 01 03 19 02 _ n0nn OPERATING _ THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR 6: (Chpck nil that -annlvl (111 MODE (9) N 20.2201 (b) 20.2203(a)(3)(ii) _ 50.73(a)(2)(ii)(B) 50.73(a)(2)(ix)(A)

POWER _ 20.2201 (d) 20.2203(a)(4) _ 50.73(a)(2)(iii) 50.73(a)(2)(x)

LEVEL (10) 100 20.2203(a)(1) 50.36©(1)(i)(A) 50.73(a)(2)(iv)(A) 73.71(a)(4) 20.2203(a)(2)(i) 50.365(1 )Ii = 50.73(a)(2)(v)(A) = 73.71(a)(5) 20.2203(a)(2)(ii) ____

50.36©(2) 50.73(a)(2)(v)(B) - OTER Specify in Abstract below or in 20.2203(a)(2)(iii) 50.46(a)(3)(ii) 50.73(a)(2)(v)(C) NRC Form 366A 20.2203(a)(2)(iv) 50.73(a)(2)(i)(A) 50.73(a)(2)(v)(D) 20.220i(a)(2)(v) 50.73(a)(2)(i)(B) 50.73(a)(2)(vii) 20.2203(a)(2)(vi) __ 50.73(a)(2)(i)(C) __ 50.73(a)(2)(viii)(A) 20.2203(a)(3)(i) 50.73(a)(2)(ii)(A) 50.73(a)L2)(viii)(B)

LICENSEE CONTACT FOR THIS LER (12)

NAME TELEPHONE NUMBER (Include Area Code)

Stephen Prussman, Licensing Engineer 914-736-8856 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

CAUSE SYSTEM COMPONEN T

MANU-FACTURER REPORTABLE TO EPIXI I CAU SE SYSTEM COMPONENT MANU-FA CTURER REPORTABLE TO EPIX SUPPLEMENTAL REPORT EXPECTED (14) MONTH DAY YEAR YES (If yes, complete EXPECTED SUBMISSION DATE). l' NO EXPECTED l l l 1l EXPECTED lll

__ _ _ _ _ _ _ _ __ l l l SUBMISSION l_ __l ARSTRACT (I imit tn 140n CnqrRA I A ::nnrnximAtPlv 1S cinnlp-nn pdrltvnpwritthn linpsl (11 RI On February 25, 1998, with the plant at 100% power, Operations found that the plant was outside its design basis because a loss of ventilation to the cable spreading room could result from a failure of the cable spreading room C02 fire suppression system, a failure of the electrical tunnel fire detection system, or a design basis event (loss of offsite power or safety injection). This condition could have adversely affected the operation of safety-related systems and/or components located in the room. This event was caused by human error during the design process. Immediate corrective action was taken to post a fire watch, disable the C02 control circuitry interlock (affects fire dampers), and restrain the fire door from automatically shutting. This event was identified as part of the extent of condition for LER 97-010 and was reported to the NRC as a one hour report. Corrective actions included modifying the fire protection system, clarifying the design criteria, and assessing past event evaluations. There is no significant effect on public health and safety from postulated events.

NRC FORM 366 (1-2001)

NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001)

LICENSEE EVENT REPORT (LER)

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) [ PAGE (3)

YEAR SEQUENTIAL REVISION

_ NUMBER I NUMBER Indian Point 3 105000286 98 -- 001 -- 01 2 OF 6 NARRATIVE (If more space is required, use additional copies of NRC Form 366A) (17)

DESCRIPTION OF EVENT Note: The Energy Industry Identification System Codes are identified in the brackets { }

On February 25, 1998, with the plant at 100 percent power, Operations found that the plant was outside its design basis because a loss of ventilation to the cable spreading room (CSR) could result from a failure of the CSR C02 fire suppression system {LW}, a failure of the electrical tunnel (ET) fire detection system, or a design basis event (loss of offsite power or safety injection). The CSR ventilation fans {FAN} are not safety-related, so the CSR depends upon the ET ventilation system to maintain the temperature of the CSR within equipment design limits during design basis events. This event was identified as part of the extent of condition for LER 97-010 and was reported to the NRC as a one hour report. Immediate corrective action was taken to correct the as found condition by posting a fire watch and by assuring that no failure could cause loss of ventilation (the fire door separating the CSR and ET was restrained open and the C02 control circuitry interlock that would shut the fire dampers was de-energized).

The Design and Analysis Group identified the potential for loss of CSR ventilation due to a fire protection system failure while evaluating the extent of condition for LER 97-010. The evaluation determined that a failure or inadvertent operation of the CSR C02 fire suppression system detectors or circuitry due to a seismic event or a single relay failure could actuate the C02 system which could shut down CSR exhaust fans, 31, 32, could shut down battery room exhaust fans 1, 2, and could close louver L-320, fire dampers FP-DF-10, FP-DF-11, FP-DF-12, FP-DF-13, FP-DF-50, and fire door FDR-30-CB.

These actuations isolate the CSR from the ET and from outside air. The evaluation also determined that a failure or inadvertent operation of the ET smoke detection system (detectors and circuitry are not seismically designed or single failure proof) or loss of power could cause Fire Door FDR-30-CB to close which would isolate the ET fans from the CSR during design basis events.

The fire protection system was designed to meet the requirements of Branch Technical Position (BTP) APCSB 9.5-1 (May 1, 1976) and Appendix A to BTP APCSB 9.5-1 (August 23, 1976) which stated: Postulated fires or fire protection system failures need not be considered concurrent with other plant accidents or the most severe natural phenomena; Failure or inadvertent operation of the fire suppression system should not incapacitate safety-related systems or components. To apply these criteria, the fire protection system design should have considered the consequential effects of the plant accidents and severe natural phenomena in order to preclude failure and, when electrically interconnected with a safety system, should have considered the affects of single failure.

NRC FORM 366A (1-20011 NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001)

LICENSEE EVENT REPORT (LER)

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)

YEAR SEQUENTIAL REVISION NUMBER INUMBER Indian Point 3 .05000286 98 - 001 - 01 3 OF 6 NARRATIVE (If more space is required, use additional copies of NRC Form 366A) (17)

During normal operation, the failure or inadvertent operation of the ET fire detection system or the CSR C02 fire suppression system would be annunciated in the control room (CR) by non safety-related alarms associated with the Fire Display Control Panel. A loss of Battery Room ventilation would also be annunciated for the CSR event. The alarm response procedures do not specify the restoration of ventilation but the off normal procedure used to respond to plant fires identifies detailed procedures for restoration of ventilation. Modification MMP 94-03-055 CBHV installed a safety- related room high temperature alarm and the associated alarm response procedure (ARP-13) was revised to restore ventilation following investigation of an alarm. ARP-13 was found to provide inadequate guidance for restoring ventilation. This guidance is no longer required to address the single failures or consequential failures of this event due to the corrective actions already taken.

A failure or inadvertent operation of the ET fire detection system or CSR fire suppression system could occur as a consequence of a seismic event (this was assumed because the detectors and circuitry of these systems are not seismically qualified), or as a consequence of a design basis event (the fire door would shut on loss of offsite power or load stripping due to SI). The CSR fire suppression system could actuate as a consequence of a single failure postulated during a design basis event (this was assumed because of the C02 system is electrically connected to the ventilation system so the effects of a single failure of the fire protection system must also be considered in ventilation system design basis events).

The cable spreading room contains safety-related equipment and non safety-related equipment in the following plant systems: 125VDC, 125VAC, reactor protection, pressurizer pressure control and rod control. A loss of ventilation could adversely affect the operation of this equipment.

This event was not identified while evaluating other ventilation system design deficiencies. This event was identified as part of the extent of condition for LER 97-010. Past engineering evaluations did not identify the events reported in this LER or LER 97-010. The reasons were evaluated and corrective action was identified and initiated. The related LERs are 93-048,94-006, 95-003,95-006 and 95-020. LER 93- 048 reported single failures that could cause loss of ventilation. The engineering evaluation for the event did not look at the fire protection relay because it was outside the ventilation system boundary. LER 94-006 identified single electrical failures in the control room ventilation system. LER 95-003 reported that a single failure of fire protection system relay could cause loss of ventilation in the switchgear room and the lower cable tunnel. LER 95-006 reported that the Appendix R analysis did not adequately consider the effects of a fire induced loss of ventilation due to inadvertent C02 or ventilation system operation in the cable spreading room, switchgear room, and emergency diesel generator cells. LER 95-006 reported that the initial C02 modification classified portions of the C02 system as Category I since the areas they protect contains safety-related systems. The LER also noted that the subsequent evaluation and upgrade of components of the CSR did not identify the reported failure modes. The corrective action upgraded procedures but did not address the potential failure identified here or in LER 97-010. LER 95-020 summarized the issues from the Appendix R reanalysis.

NRCr FnRM 'qAAA (1-27nn1 NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001)

LICENSEE EVENT REPORT (LER)

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)

IYEAR I SEQUENTIALI REVISION l NUMBER NUMBER Indian Point 3 05000286 98 - 001 - 01 4 OF 6 l NARRATIVE (If more space is required, use additional copies of NRC Form 366A) (17)

CAUSE OF THE EVENT This event was caused by human error during the design process. As reported in LER 95-006, this error occurred during the evaluation and subsequent upgrade of components to safety-related in the cable spreading room ventilation system. The error was due to a lack of understanding and inadequate documentation of the ventilation and fire protection system design bases.

CORRECTIVE ACTIONS The following corrective actions have been performed in order to address the deficiencies identified during the investigation of this event and to prevent recurrence:

On February 25, 1998 a fire watch was posted; the C02 control circuitry interlock with the control circuitry of the fire dampers was disabled and the fire door was restrained from automatically shutting.

Modification MMP 97-03-400 FP C02 modified the fire protection system so that ventilation for the CSR would not be lost as a consequence of a design basis event or due to a single failure.

Clarified and documented the design basis of the fire protection and the ventilation systems to clearly identify the design criteria in this LER.

The safety significance of this event is in this LER update.

ANALYSIS OF THE EVENT This event was reportable under 10 CFR 50.73 (a) (2) (ii) (B). A failure or inadvertent operation of the CSR C02 suppression system or ET fire detection system as well as design basis events (loss of offsite power and safety injection) could result in a loss of ventilation required to support the continued operational environment of safety related equipment in the CSR. This could have placed the plant outside its design basis.

Similar events (failure of a fire suppression system adversely affecting safety-related systems/components) were reported in LERs93-048, 94-006,95-003, 95-006,95-020 and 97-010.

NRC FORM 366A (1-20011 NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001)

LICENSEE EVENT REPORT (LER)

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)

YEAR I SEQUENTIAL REVISION NUMBER NUMBER Indian Point 3 05000286 98 -- 001 -- 01 5 OF 6 NARRATIVE (If more space is required, use additional copies of NRC Form 366A) (17)

SAFETY SIGNIFICANCE This event did not have a significant effect on the health and safety of the public. No event has occurred which resulted in the consequential loss of the CSR ventilation system so there has been no actual effect on public health and safety.

The potential for individual ventilation system to be unavailable has been previously evaluated and found to have no significant effect on public health and safety. Based on the following, it was concluded that the consequential effects of common cause events would not have had a significant effect on public health and safety.

Plant ventilation systems have been affected by the design interface with the fire protection system as well as by the provisions for electrical power to the ventilation systems. The operation of the cable spreading room (CSR), switchgear room (SR) and emergency diesel generator (EDG) ventilation systems is challenged due to the issues identified in this LER as well as LERs93-048, 95-003,95-006, and 97-010. LER 93-048 reported that MCC 39, supporting both SR fans, stripped from EDG due to a loss of offsite power (LOOP), with or without a coincident safety injection (SI) signal, and the fans had non-seismic instrumentation. LER 95-003 reported a single, non safety, fire protection relay that could affect both SR fans. LER 95-006 reported a failure to consider spurious or fire induced loss of ventilation in the CSR, SR, and EDG cells. LER 97-10 reported that a common cause failure (e.g., seismic event) could cause the C02 system to actuate on all three diesels with the consequential loss of EDG cooling. This LER reported that CSR cooling could be lost due to a single fire protection relay failure, a seismic event or a LOOP.

The safety significance of the deficiencies was considered in each of the referenced LERs. The potential for a common cause event to affect all of the systems was not considered. This potential is as follows:

• For a LOOP, the LERs identify that the SR ventilation fans would have been stripped and the CSR would have been isolated from the cable tunnel fans, their source of cooling, as a consequence. The use of operator action to mitigate the loss of SR fans was discussed in LER 93-048. The isolation of the CSR from the electrical tunnel as a consequence of the event would have been indicated in the CR by an out of position light and, after 90 seconds, an audible alarm. Operator action to open the door between the electrical tunnel and CSR would be practical because the alarms would identify the need for this action to the control room operators. The LOOP would not have an affect on the EDG ventilation.

• A postulated seismic event could cause a consequential loss of ventilation in the SR, CSR and EDG cells. The LERs identify the potential for failure of non-safety equipment to cause a loss of ventilation in the SR, CSR and EDG cells due to the fact that the C02 (or fire protection) circuitry was not designed to withstand a seismic event. Also, the seismic event could cause a NRC FORM 366A (1-2001)

NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-200 1)

LICENSEE EVENT REPORT (LER)

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)

YEAR SEQUENTIAL REVISION NUMBER NUMBER Indian Point 3 105000286 98 -- 001 -- 01 6 OF 6 NARRATIVE (If more space is required, use additional copies of NRC Form 366A) (17)

LOOP (this is plant design basis) with consequential loss of the SR and CSR ventilation. The loss of SR and CSR due to LOOP is discussed above and LER 97-010 assessed the use of operator action to re-establish EDG ventilation.

The loss of ventilation in the SR, CSR and EDG cells is not an expected consequence of a seismic event. The design earthquake for Indian Point 3 (i.e., 0.15g ground acceleration with a 15 second duration) is of low intensity compared to that used to design most plants. Under this type earthquake it is unlikely that offsite power would have been lost or that multiple failures of ventilation would occur. This conclusion is reached based on the work done to address Unresolved Safety Issue A-46, "Seismic Qualification of Equipment in Operating Plants." NUREG 1030, "Seismic Qualification of Equipment in Operating Nuclear Power Plants, Unresolved Safety Issue A-46," provides the technical bases for resolution. That NUREG documents the demonstrated ability of power plants to operate through an earthquake and the continued availability of offsite power. Relay chatter is an issue of concern so it would be reasonable to assume that some of the ventilation systems would be lost but this would be within the scope of events already evaluated.

• A design basis tornado (DBT) is postulated to cause a consequential loss of offsite power that would render SR and CSR ventilation inoperable. The DBT could also cause damage resulting in inadvertent operation of the fire protection relays in the turbine building and administration building (not designed for the DBT) that would result in loss of SR, CSR and EDG ventilation. The probability that a tornado would cause the loss of offsite power is low and the loss of SR and SR ventilation was discussed above. The probability of tornado is low and the further probability that it would cause inadvertent relay actuation in the three systems without destroying them is considered limited. Although the probability of damage to the relays was not estimated, the risk associated with tornado events is not high. The IP3 examination of external events (IP3 Report IP3-RPT-UNSPEC-02182, "IP3 Examination of External Events," September 1997) found the probability of any tornado striking IP3 to be 1.59E-4/year.

The frequency of a tornado classified as F3 or higher (i.e., wind speeds in excess of 153 mph) is 2.23E-6/year. For tornados with wind speeds in excess of 180 mph, the frequency decreases to 8.62E-7/year. For the design basis tornado (DBT), which has a 300 mph wind speed, the frequency decreases to 1.02E-9/year.

• A high energy line break (HELB) that trips the turbine is postulated to cause a consequential loss of offsite power that would render SR and CSR ventilation inoperable. A HELB in the turbine building which trips the turbine could also cause damage to the fire protection system relays in the turbine building that would result in loss of EDG ventilation. This sequence of events is not considered probable for this assessment. A turbine trip does not normally cause a loss of offsite power because the grid is normally in a stable condition. Therefore the SR and CSR ventilation would remain in operation. A HELB in the turbine building is considered an unlikely event due to programs that assess erosion corrosion and regular assessment of piping.