ML17291A442

LER 94-013-02:on 940622,determined That Containment Isolation Provisions for Both Containment Monitoring Sys Inoperable.Caused by Design Error.Design Change Will Be implemented.W/941014 Ltr

ML17291A442
Person / Time
Site:	Columbia
Issue date:	10/14/1994
From:	Foley C, Parrish J WASHINGTON PUBLIC POWER SUPPLY SYSTEM
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
GO2-94-236, LER-94-013, LER-94-13, PER-294-0602, PER-294-0869, PER-294-602, PER-294-869, NUDOCS 9410190125
Download: ML17291A442 (9)

Text

.(ACCEI ERATED BIDS PROCI'.SSliG)

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9410190125 DOC.DATE: 94/10/14 NOTARIZED: NO 'OCKET FACIE:50-397 WPPSS Nuclear Project, Unit 2, Washington Public Powe 05000397 AUTH. NAME AUTHOR AFFILIATION FOLEY,C.J. 'ashington Public Power Supply System PARRISH,J.V. Washington Public Power Supply System RECIP.NAME RECIPIENT AFFILIATION

SUBJECT:

LER 94-013-02:on 940622,determined that containment isolation provisions .for both containment monitoring sys inoperable. Caused by design error. Design'hange will be implemented.W/941014 ltr.

DISTRIBUTION CODE: IE22T COPIES RECEIVED:LTR / ENCL / SIZE: 7 TITLE: 50.73/50.9 Licensee Event Report (LER), Incident Rpt, etc.

NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD4-2 PD 1 1 CLIFFORD,J 1 1 INTERNAL: ACRS 1 1 EOD/+OAB/DBP 2 2 AEOD/SPD/RRAB 1 1 - -LE CENTER~02 1 1 NRR/DE/EELB 1 1 NRR/DE/EMEB 1 1 NRR/DORS/OEAB 1 1 NRR/DRCH/HHFB 1 1 NRR/DRCH/HICB 1 1 NRR/DRCH/HOLB 1 1 NRR/DRSS/PRPB 2 2 NRR/DSSA/SPLB 1 1 NRR/DSSA/SRXB 1 1 NRR/PMAS/IRCB-E 1 1 RES/DSIR/EIB 1 1 RGN4 FILE 01 1 1 EXTERNAL: EG&G BRYCE,J.H 2 2 L ST LOBBY WARD 1 1 NOAC MURPHY,G.A 1 1 NOAC POORE,W. 1 1 NRC PDR 1 1 NUDOCS FULL TXT 1 1 iNOTE TO ALL"RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE iVKSTE! CONTACT TI IE DOCK'CLIENT CONTROL DESh. ROOWI PI-37 I EXT. 504. TOS3 ) TO I'.LIMINATE )'OI:R NAifL F ROTI DISTRIBUTION LISTS I'OR DOCI. MEN I'S YOL')ON"I'L'I'.D!

FULL TEXT CONVERSION REQUIRED TOTAL NUMBER OF COPIES REQUIRED: LTTR 27 ENCL 27

ti WASHINGTON PUBLIC POWER SUPPLY SYSTEM P.O. Box 96B ~ 3000 George Washington Way ~ 'ichland, Washington 99352 October 14, 1994 PER 294-0602 G02-94-236 PER 294-0869 Docket No. 50-397 Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555

Subject:

NUCLEAR PLANT WNP-2, OPERATING LICENSE NPF-21 LICENSEE EVENT REPORT NO. 94-013-02 transmitted herewith is Licensee Event Report No. 94-013-02 for the WNP-2 Plant.

LER 94-013-00 reported a design deficiency in the containment isolation logic for the Containment Monitoring System (CMS). As part of the associated corrective actions, a detailed review of other containment isolation logics was performed to verify acceptable design. The subject LER revision reports a similar design deficiency discovered during this review. It should be noted that the review is complete as of this writing and no other such deficiencies were identified.

Should you have any questions or desire additional information, please call me or D.A. Swank at (509) 377-4563.

Sincerely,

. Parrish (Mail Drop 1023) sistant Managing Director, Operations JVP/CJF/my Enclosure CC: LJ Callan, NRC-RIV KE Perkins, Jr., NRC RIV, Walnut Creek Field Office NS Reynolds, Winston & Strawn NRC Sr. Resident Inspector (Mail Drop 927N, 2 Copies)

INPO Records Center - Atlanta, GA DL Williams, BPA (Mail Drop 399) 9410190125 'P41014 g~pYP PDP. ADOCK 05000:97 PDF't S

LICENSEE EVE@REPORT (LER)

AGILITY NAME (I) DOCKET NUMB R ( ) PAGE (3)

Washin ton Nuclear Plant - Unit 2 0 5 0 0 0 3 9 7 I DF ITLE (4)

DESIGN ERROR IN ELECTRICAL CIRCUITRY FOR CONTAINMENT ISOLATION EVENT DATE (5) LER NUMBER ( REPORT DATE 7 OTHER FACILITIES INVOLVED (8 MONTH DAY YEAR YEAR SEQUENTIAL EVI 5 ION MONTH DAY YEAR FACILITY NAMES CKE UMB R (5)

NUMBER UMBER 050 0 6 2 2 94 9 4 0 1 3 0 2 I 0 1 4 9 4 50 PERATING MIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR II: (Ch eck one or more of the fo llowing) (11)

ODE (9)

O'NER LEVEL 20.402(b) 0.405(C) 0.73(a)(2)(iv) 77.71(b)

'10) =

0.405(a)(1)(i) 0.36(c) 1) X 0.73(a)(2)(v) 73.73(c) 0.405(a)(1)(ii) 50.36(c) 2) 50.73(a)(2)(vii) THER (Specify in Abstract 0.405(a)(1)(iii) 0.73(a) 2)(i) 50.73(a)(2)(viii)(A) elow and in Text, HRC 0.405(a)(1)(iv) 50.73(a) 2)(ii) 50.73(a)(2)(viii)(B) Form 366A) 20.405(a)(1)(v) 50.73(a)(2)(iii) 50.73(a)(2)(x)

LICENSEE CONTACT FOR THIS LER (12)

TELEPHOHE NUMBER REA CODE C.J. Foley, Licensing Engineer 5 0 9 7 7 - 4 3 2 5 COMPLETE ONE LIHE FOR EACH COMPOHEHT FAILURE DESCRIBED IH THIS REPORT (13)

CAUSE SYSTEM COMPONENT MANUFACTURER EPORTABLE CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE 0 NPRDS TO NPRDS NA NA SUPPLEMEH1'AL REPORT EXPECTED (14) EXPECTED SUBMISSION MONTH DAY YEAR ATE (15)

YES (If yes, complete EXPECTED SUBMISSIOH DATE) HO TIIACT nd)

On June 22, 1994, it was determined that containment isolation provisions for both Containment Monitoring Systems were inoperable because the design of the electrical circuitry was such that failure of a single electrical relay could prevent closure of the solenoid-operated containment isolation valves associated with those particular systems. The plant was in an annual refueling and maintenance outage.

The root cause is design error during initial plant construction. A plant modification was executed to revise the electrical circuitry to eliminate the design fiaw causing the deficiency. In addition, a detailed review of the logic circuits for the other electrically powered isolation valves listed in Technical Specification 3.6.3 was performed. One other case was discovered in which failure of a single relay could prevent closure of solenoid-operated containment isolation valves associated with the hydraulic control system for the two fiow control valves for the Reactor Recirculation System. A request for enforcement discretion and an emergency Technical Specifications Amendment was processed to allow continued operation until the next shutdown at which time a modification will be implemented to eliminate the design fiaw causing the deficiency,

LICENSEE EVENT REPORT (4)

TEXT CONTINUATION ACILITY NAME (1) OOCKET NUHBER (2) LER NUHBER (8) AGE (3)

Year umber ev. No.

. Washington Nuclear Plant - Unit 2 0 5 0 0 0 3 9 7 4 13 02 2 OF 6 ITLE (4)

DESIGN ERROR IN ELECTRICAL CIRCUITRY FOR CONTAINMENT ISOLATION Even De cri tion There are two cases of the same type of event, as follows:

Case No. 1 On June 22, 1994, the plant was in operational condition 5 (refueling) at 0% power. An electrical engineer, evaluating a report provided'by INPO about a condition discovered at another nuclear plant, determined that a single failure of an electrical relay [RLYJ used in containment isolation logic circuits [JM] could prevent closure of solenoid-operated containment isolation valves [ISV] for the WNP-2 Containment Monitoring System [D]

(CMS). The NRC was immediately notified per 10CFR50.72(b)(1)(ii)(B) because this condition was a violation of the single-failure criterion.

Case No. 2 On September 15, 1994, the plant was in operational condition l,at 100% power. An electrical engineer discovered that a single failure of an electrical relay used in containment isolation logic circuits [JM] could prevent closure of solenoid operated containment isolation valves [ISV] for the hydraulic system used to control the position of the Qow control valves [FCV] of the Reactor Recirculation System [AD]. The NRC was immediately notified per 10CFR50.72(b)(i)(ii)(B) because this condition was a violation of the single failure criterion.

Immediate orrective Action For the first case, the Containment Monitoring System was declared inoperable on June 22, 1994. For the second case, the isolation valves for the Reactor Recirculation System Valve Positioning System were declared inoperable on September 15, 1994.

Fu her Evaluati n Case No. 1 Two Containment Monitoring Systems serve as reactor coolant pressure boundary [AD] leak detection systems in conformance with Regulatory Guide 1.45. The closed loop systems, installed in cabinets located in the secondary containment area, draw samples of primary containment [NH] atmosphere through radiation monitors [MON],

arid return the samples to the primary containment. Containment isolation valves are provided for each system pursuant to GDC 56 as follows: 1) two solenoid-operated valves located outside of primary containment are installed in series in the sample supply line, and 2) a single solenoid-operated valve located outside of containment plus a check valve located inside containment provides isolation for the sample return line.

LICENSEE EVENT REPORT ('+)

TEXT CONTINUATION AGILITY NAME (1) OOCKET NUMBER (2) LER NUMBER (8) AGE (3) ear umber ev. No.

Washington Nuclear Plant - Unit 2 0 5 0 0 0 3 9 7 4 013 02 3 OF 6 ITLE (4)

DESIGN ERROR IN ELECTRICAL CIRCUITRY FOR CONTAINMENT ISOLATION The solenoid operated valves are spring-loaded to close upon interruption of power to the solenoid [SOL].

The electrical circuitry that controls the position of these valves involves a one-out-of-two "taken twice" logic requiring receipt of either a "high" drywell pressure or "low" reactor water level signal in two separate circuits to interrupt power to the solenoids to allow the valves to close. Division 1 power is used to operate the logic associated with the isolation valves for one of the monitoring systems, and Division 2 power is used for the other. Each set of three valves is controlled by two electrical relays that must change position to allow the valves to close; the two relays for each set are within a single division. With this arrangement, failure of one of the two relays in the logic could prevent closure of its associated three isolation valves, which does not satisfy the single failure criterion as applied to containment isolation.

Case No. 2 The two Reactor Recirculation (RRC) System flow control valves, located within primary containment, are positioned by separate hydraulic systems located outside of primary containment. Small bore piping transports hydraulic fluid from the hydraulic systems to the flow control valves; the interior of this piping is filled with hydraulic Quid, and is operated at a pressure of approximately 1800 psig when the RRC system is in operation.

There are eight separate hydraulic piping runs, each provided with two solenoid-operated fail-closed valves pursuant to the requirements of GDC 56, for a total of sixteen containment isolation valves; the valves are physically located outside of primary containment for environmental and maintenance reasons. The piping is designed and fabricated to ASME Section III, Seismic 1, requirements between the primary containment shell and the outer isolation valve, and to ANSI B31.1, Seismic 2+, requirements elsewhere.

The electrical circuitry that controls the position of these valves involves a one-out-of-two "taken twice" logic requiring receipt of either a "high" drywell pressure or "low" reactor water level signal in two separate circuits to interrupt power to the solenoids to allow the valves to close. Division 1 power is used to operate the logic associated with the isolation valves for one of the hydraulic systems, and Division 2 power is used for the other.

Each set of eight valves is controlled by four electrical relays that must change position to allow the valves to close; the relays for each set are within a single division. With this arrangement, failure of any of four different relays in the logic to open could prevent closure of eight isolation valves, which does not satisfy the single failure criterion as applied to containment isolation.

oot ause The root cause is design error during initial plant construction.

In Case No. 1, the original design, released in 1979, included appropriate divisional separation, and consequently was not subject to this deficiency. However, a design change in 1982 eliminated the divisional separation, thereby causing the deficiency as it existed when found. No records have been located documenting the rationale for the 1982 change.

LICENSEE EVENT REPORT (+I)

TEXT CONTINUATION AGILITY NAME (1) OOCKET NUMBER (2) LER NUMBER (8) PAGE (3)

Year Number ev. No.

Washington Nuclear Plant - Unit 2 0 5 0 0 0 3 9 7 4 013 02 4 F 6 ITLE (4)

DESIGN ERROR IN ELECTRICAL CIRCUITRY FOR CONTAINMENT ISOLATION In Case No. 2, the original design, released in 1981, was based on GDC 57 and thus had only a single containment isolation valve in each line. In the licensing process the design was changed in 1982 to conform to GDC 56 requirements. The powering arrangement for the double valves was described in the FSAR as being uni-divisional so that no single loss of power could close some isolation valves in both sets of hydraulic lines thus rendering both RRC fiow control valves inoperable. However, susceptibility to single component failure was not adequately addressed.

Further orrective Action A complete review of the design for the automatic electrically-powered containment isolation valves listed in

'Ibchnical Specification 3.6.3-1 was performed to ensure the single failure criterion was met. Only two cases were found wherein a single component failure could prevent containment isolation. These two cases are covered by this LER.

Case No. 1 The configuration of the control and indication circuitry for the solenoid-operated valves in the sample return lines was modified to eliminate the deficiency. The modification exchanged the control and indication circuits for one of the solenoid valves in each of the sample supply lines with that of the other electrical division, so that one of the two valves in series is actuated by the Division 1 logic and the other by the Division 2 logic. With this arrangement, failure of a single relay in either division's logic cannot prevent containment isolation.

Case No. 2 On September 15, 1994, WNP-2 was granted interim enforcement discretion to permit continuing operation in violation of Technical Specification 3.6.3 until an emergency Technical Specification change could be processed.

This was confirmed by the NRC in writing on September 20, 1994. On September 18, an emergency Technical Specification request was formally filed to allow continued operation to the next shutdown but not later than May 15, 1995. In this interim period the systems will be operated normally. Should an event arise calling for isolation of primary containment and should a relay failure prevent automatic closure of one or more isolation valves for the RRC hydraulic system, plant operators will manually close the valves using switches available in the Control Room. Should that be unsuccessful, the operators will pull fuses in the Control Room, thus removing all power from the isolation valves and allowing them to close.

During the next reactor shutdown, a design change will be implemented such that the two isolation valves in each line will be supplied from different logic, thus eliminating the susceptibility to single component failure.

LICENSEE EVENT REPORT OR)

TEXT CONTINUATION AGILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (8) PAGE (3)

Year Number ev. No.

Washington Nuclear Plant - Unit 2 0 5 0 0 0 3 9 7 4 013 02 5 OF 6 ITLE (4)

DESIGN ERROR IN ELECTRICAL CIRCUITRY FOR CONTAINMENT ISOLATION f i nifi n Case No. 1 The equipment and tubing tYBG] comprising the Containment Monitoring Systems is a leak-tight closed loop boundary isolating the primary containment atmosphere from secondary containment. These systems are not qualified as extensions of primary containment, but are equipped with pressure switches tPS] to isolate the sample supply and return lines from the system if the system pressure should rise to 2 psig. Leakage from the supply and return tubing or from the monitoring systems would enter the secondary containment which is designed to mitigate radioactive releases. Consequently, two barriers exist to limit the release of radioactivity in the event of a LOCA and concurrent failure of the containment isolation valves to close (the closed loop systems and secondary containment).

An existing analysis was available to assess the radiological consequences of a postulated accident involving the following assumed simultaneous failures: a LOCA involving core damage, failure of the containment isolation valves in the sample return line to close, and a breach of the closed loop system outboard of the open containment isolation valves. Based on the assumptions, the analysis showed that the 10CFR100 reference values for thyroid exposure at the exclusion boundary and GDC 19 thyroid limits for the control room would be exceeded. The assumptions included one open path from primary containment, while the deficiency described in this LER could involve two open paths which also result in exceeding 10CFR100 reference values and GDC 19 limits.

.Using figures from WNP-2 probabilistic risk studies, the probability of a LOCA with accompanying release of radioactivity to the containment atmosphere is 1.78 x 10'/year and the probability for a single relay to fail to open is 6 x 10~/year. The aggregate probability for radioactive release from primary containment is (1.78 x 10')

x (6 x 10') x 2 = 2 x 107/year; the factor of 2 is used because two relays must change position to effect containment isolation.

Case No. 2

'The'equipment and piping providing RRC valve actuation hydraulic power is a leak tight closed boundary which is normally filled with hydraulic fiuid operating at 1800 psig, Consequently, three barriers exist to limit the release of radioactivity in the event of a LOCA and concurrent failure of the containment isolation valves to close (the primary containment, the closed hydraulic piping, and the secondary containment).

Using figures from WNP-2 probabilistic risk studies, the probability of a LOCA with accompanying release of radioactivity to the primary containment is 1.78 x 10'/year and the probability for failure of a single relay to fail to open is 6 x 10'/year. Assuming for conservatism that the hydraulic piping were to fail both inside and outside of primary containment concurrent with this event, the aggregate probability for release of radioactivity to the secondary containment and then to the environment is (1.78 x 10') x (6 x 10') = 1 x 10'/year. These assumptions would yield essentially the same radiological consequences as is discussed under Case No. 1.

'ICENSEE EVENT REPORT (l)

TEXT CONTINUATION AGILITY NANE (1) OOCKET NUMBER (2) LER NUNBER (8) AGE (3)

Year umber ev. No.

Mashington Nuclear Plant - Unit 2 0,5 0 0 0 3 9 7 4 013 02 6 OF 6 ITLE (4)

DESIGN ERROR IN ELECTRICAL CIRCUITRY FOR CONTAINMENT ISOLATION Summary While neither the Containment Monitoring System nor the hydraulic piping external to the outboard isolation valves are qualified as extensions of containment, they do consist of closed loops that function as a pressure boundary during normal plant operations. The probability of failure of the pressure boundary of those systems is low, but not quantifiable, because the monitoring systems have not previously been considered in probabilistic risk studies at WNP-2. However, those boundaries do provide further reduction of the aggregate failure probabilities calculated above which are only slightly different from the 1.2 x 10'/year probability of release of radioactivity by a large LOCA to the uncontrolled environment from all events evaluated by the WNP-2 probabilistic risk analysis.

Based on the above, it is concluded that the design error involving the electrical circuitry used to control containment isolation valves for the Containment Monitoring Systems was of low safety significance.

LER 94-009 "Incorrect Isolation Valve Component Selection," reported installation of excess flow check valves as inboard isolation valves in the sample return lines for the Containment Monitoring Systems. This type of check valve was determined to be unable to satisfy requirements for the particular installation since such valves could open without operator action when primary containment pressure had dropped below approximately 3.5 psid after a LOCA. The corrective action was to replace the excess flow check valves with ordinary check valves. However, that corrective action could not have been expected to address the deficiency of this LER because it involved a passive mechanical device problem, while the present event involves an electrical design error.

~ " ~

~

lp f