ML16194A286

E-Mail - Mcguirai Ice Condenser Door Position Alternate Verification, (ML16089A228) CAC Nos. MF7526 and MF7527

ML16194A286
Person / Time
Site:	McGuire, Mcguire
Issue date:	07/12/2016
From:	V Sreenivas Plant Licensing Branch II
To:	Capps S Duke Energy Carolinas
Sreenivas V, NRR/DORL/LPLII-1, 415-2597
References
CAC MF7526, CAC MF7527
Download: ML16194A286 (2)

Text

From: Sreenivas, V Sent: Tuesday, July 12, 2016 2:00 PM To: steven.Capps@duke-energy.com Cc: Robertson, Jeffrey N; Richards, Brian H; Vu, Phong T; Murphy, George M; Miller, Ed; Green, Brian; Bettle, Jerome

Subject:

McGuire: RAI Ice Condenser Door Position Alternate Verification, (ML16089A228) CAC Nos. MF7526 and MF7527 Please find the following Request for Additional Information for the review of license amendment Request dated March 24, 2016 (Adams Accession No. ML16089A228)

Balance of Plants Branch (SBPB):

1. Does a non-functional ice condenser lower inlet door (LID) position limit switch (an invalid open alarm input) render a LID inoperable?

2. The LAR states that a License Amendment is needed to preclude an unnecessary plant shutdown caused by an invalid "ICE COND LOWER INLET DOORS OPEN" alarm. This alarm can be the result of a single invalid LID position indication. Justify the proposed TS change providing no limit to the number of LIDs with invalid position indication.

3. The LAR indicates that SR 3.6.13.1 requires verification that all lower inlet doors indicate closed by the Inlet Door Position Monitoring System and that this is normally performed in the CR by observance of the associated annunciator alarm status. In the event of one or more LID invalid door open alarm inputs the open/closed status verification of the remaining LIDs would be performed using the local door position display panel located in upper containment on a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> frequency per TS SR 3.6.13.1, in accordance with what the Surveillance Frequency Control Program allowed for a maximum interval at that time. The local panel provides zone by zone indication of all 8 doors in a zone being shut or at least one door in a zone being open.

a. Would this change in SR 3.6.13.1 method verify closed position indication for all other LIDs or just all other LIDs in unaffected zones? Would the other LIDs in the affected zone(s) be remote visually verified closed on the 14 day interval?

b. Justify extended operation with the control room annunciator alarm locked in and LID position monitoring once each 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or longer instead of continuous.

4. The proposed TS change does not have a completion time for continued operation with one or more LIDs with non-functional position limit switch (an invalid open alarm input).

Would TS LCO 3.0.4 permit mode change to a mode of applicability without restoring proper LID position indication function?

PRA Operations and Human Factors Branch (APHB):

Attachment 1 of the March 24, 2016 license amendment request (LAR) contains a marked up revision of REQUIRED ACTION B.1 which requires operators to Verify maximum ice bed temperature is 27°F once per 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

This revision adds a new NOTE (emphasis added): Required Action B.2.1 applies only when one or more ice condenser lower inlet doors are inoperable due to having an invalid open alarm.

REQUIRED ACTION B.2.1 goes on to state Verify affected lower inlet door is closed once per 14 days OR conduct REQUIRED ACTION B.2.2.

The NOTE does not clearly indicate when, or how to determine that the alarm is truly invalid (as opposed to being suspected invalid). REQUIRED ACTION B.2.1 provides one means for verifying that a suspected invalid alarm is truly invalid (by verifying that the door is truly closed), however, under some conditions it directs operators away from REQUIRED ACTION B.2.1 without directing them to an alternate method for verification.

This strategy has the potential for causing complacency in operators similar to what was observed in the Three Mile Island accident (see NUREG/CR-1270 for more information). Operators knew of a long-standing leak that caused temperature indications on the pressurizer PORV exhaust pipe to be elevated during normal conditions. As a result, operators learned to expect faulted indication and subsequently altered their mental model of the system. During the accident operators ignored, or otherwise misinterpreted, valid temperature indications from the system. As a result, it took operators 138 minutes to come to the conclusion that the PORV was open. If the operators did not have the expectation that temperatures in the PORV exhaust pipe are normally high (and should therefore be ignored), they may have observed the increase in the PORV exhaust pipe temperature and come to the conclusion the PORV was stuck open much sooner and may have prevented the accident.

Please clarify the logic of this TS or revise the TS to ensure that it does not promote operator complacency.

Clarify how it is possible for operators to make the determination that the signal is invalid without performing REQUIRED ACTION B.2.1.

Describe how procedures and/or training will be used to ensure that operators do not systematically ignore what they may perceive as a chronically faulted alarm.

Please respond to this RAI by August 12, 2016. If you have any questions, please do not hesitate to contact me.

V. Sreenivas, Ph.D., CPM.,

Project Manager NRR/DORL/LPL2-1 301-415-2597