ML20155C348
| ML20155C348 | |
| Person / Time | |
|---|---|
| Issue date: | 04/30/1988 |
| From: | Israel S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20155C346 | List: |
| References | |
| TASK-AE, TASK-E802 AEOD-E802, NUDOCS 8810100008 | |
| Download: ML20155C348 (13) | |
Text
._..
9 N
e i
AE00/E802 1
i i
ENGINEERING EVAL.UATION REPORT DESIGN AND OPERATING DEFICIENCIES IN CONTROL POOM EMERGENCY VENTILATION SYSTEMS r
April 1988 Prepared by:
Sanford Israel i
i i
es o100000 eso41a ORG NEXD PNU Office for Analysis and Evaluation of Operational. Data U.S. Nuclear Regulation Commission
l
-?.
l.
INTRODUCTION Control roon habitability received attention following the Three Mile Island accident because of radiation alams actuated in the control room following the event. As part of the Three Mile Island Task Action Plan (Ref.1), item
!!!.D.3.4 required all licensees to re-examine their control rooms to assure that emergency ventilation designs would adequately protect the control room operators against the effects of toxic or radioactive gases released in an accident. Control room design requirements are embodied in General Design Criterion 19 of Appendix A to 10 CFR Part 50. Standard Review Plan Section 6.4, and Regulatory Guides 1.78 and 1.95.
Subsequently, the NRC staff sponsored a survey of control room habitability design practices which was published as Ref. 2.
This activity was part of a program to address Generic issue 83.
IE Infonnation Notice 86-76 cited the i
results of this survey as part of the discussion of a failed control room ventilation test at the Trojan plant.
Excessive inleakage, the principal focus of the infomation notice, compromises control room habitability in the presence of an adverse external environment.
Excessive inleakage arises from many holes in the duct work, unisolated drains, and unsealed electrical penetrations.
The survey (Ref. 2) noted that additional refinements in recent control room designs do not provide obvious improvements in assuring control room habitabi-lity, and they are more complicated.
Recent reported events highlight single failure vulnerabilities in control room emergency ventilation systems. The current study focuses on these single failures and broadens the areas of potential concern beyond inleakage problems that were addressed in the infomation notice.
The events discussed in this report cover the period from 1985 to 1987 and are based on output from the t
Sequence Coding Search System and screening a limited set of very recent inspection reports. Although this search did not capture all events, the examples provide an infomative overview of the types of single failures in control room emergency ventilation systems that have been discovered. The l
quantity of events and the breadth of plants involved amplify the generic applicabilty of this report.
2.
DESCRIPTION OF CONTROL ROOM EMERGENCY VENTILATION SYSTEM l
t Each control room ventilation system is unique; however, a generalized i
description of an installation will suffice for this report, t! sing Figure 1 I
as an example, a ventilation system for the control room envelope has two trains of HVAC and two trains of pressurization fans together with associated exhaust fans, ductwork and darpers. The HVAC units consist of an outdoor condenser portion and an indoor fan portion.
Each indoor portion includes two dampers, filters, refrigerant cooling coil, heating coil and fan.
l The pressurization fans are in a parallel arrangement and induce flow through 1
the cleanup filter train. The filter train processes control room air through HEPA and charcoal filters if the plant is subjected to airborne contamination.
Each fan is equipped with two darpers which function similarly to those in the j
HVAC portion.
I f
t I.
sj g{
(
g 1,
v.u.s gg
- E e
4
_~
[!
s *vu\\
1 s1 g
i I
SE b
i i!
L-p
~
- il i.ie Y
4 lgGT I
I I
4!
-G
- ll i.nu.
a v
e.
y- -
i EbH L j{
~
S**'*
~
@++
f u-Lv
,1 as 8
E-a j
TNT *I U
r3 l
,5,s lab s g
gI 3
I s
l E.
/,. i vi o
Sunw pow s
3 1
t s
w
&,Jr i.
,l i
iM1.,.
g
&M i.uu.
h
\\" '*\\
{
G**
l i
l i
n u
o I
n I
s wt '"
s"\\
h V*
9 1
)
- r....... j i
i I....I 4
\\
E iM i ! l :2
?
b
! I!I:1iI u
n i
P
.J s
e s-->.
)!Iea! i ! :t I
- 5
@WS*
s 3
p s
i h
m3 h
n Ii iI
-----------------J1fL-- - ---- -- -- - nn -
4 Tiie HVAC units draw air from the control room and other controlled areas ai mix the return air with fresh air from either of two outside air intakes. When a prescribed amount of makeup air is drawn into the system, the control room L
is maintained at a positive pressure.
This pressure decays when the air intakes are closed because of an adverse external environment.
When the control room is isolated, the pressurization fans are started and the air is i
recirculated through the cleanup filter.
l Other control room designs may contain other air pathways that must be isolated under adverse environmental conditions.
The complexity depends on the inter-connections between the control room and other rooms in the auxiliary building such as motor-control centers, battery rooms and locker rooms.
Emergency control room ventilation is actuated by various signals that include j
containment isolation signal and different motiitors located in the air intakes i
for nomal control room ventilation.
These monitors consist of different i
toxic gas sensors, radiation monitors and smoke detectors.
The actual emergency ventilation configuration depends upon the circumstances and can vary from a nomal filtered mode, to emergency makeup, to total isolation using only recirculation.
The standard Technical Specifications for control room emergency ventilation
)
systems require two independent ventilation trains be operable.
Surveillance on an 18 month interval verifies that the system can maintain the control room at a positive pressure in addition to other criteria.
There are no checks on i
damper positions.
3.
DESCRIPTION OF EVENTS Callaway While perfoming system flow checks to evaluate control room pressure, the j
licensee found that damper GKD0329 had been positioned so that flow to the control room air conditioning unit equipment room (CRAVER) was approximately t
160 CFM (Ref. 3). By design, the flow balancing damper was to provide 350 i
CFM while drawing 300 CFM from the room.
This balance maintains a positive i
pressure in the room relative to the auxiliary building and thereby precludes i
]
inleakage from auxiliary building.
l The chronology of mispositioning the damper could not be determined. The i
j damper identification and acceptable flow rates were not provided in the preoperational test package and surveillance requirements do not require
}
initial or Nriodic verification of the CRAVER pressure or air flow.
The i
location of the darper rade it unlikely that it had been inadvertently j
mispositioned and the damper was snug in its as found condition.
Preliminary
]
calculations showed that the dose to control room operators would exceed j
GDC 19 guidelines.
The damper was found in a nearly closed position and opening the damper l
resulted in decreasing the pressure in the control room.
The licensee left l
the damper in approximately the as-found position for almost two months while 1
l the situation was evaluated and finally corrected by flow balancing the enrgency ventilation system.
i j
l I
i
l l
.g.
l D.C. Cook l
Following a surveillance activity, it was determined that an air intake darper had been improperly positioned for 14 days (Ref. 4). Because of the interdependency of the unit 1 and 2 ventilation systems, both control rooms would have been prevented from being pressurized as required by design. A
)
later survey sponsored by NRC (Ref. 5) determined that:
"The present system appears subject to single failure, e.g.,
I single nonnal intake, emergency recirculation, and exhaust dampers and a single C1 detector for cach unit."
2 The licensee is in the process of reviewing these deficiencies.
Fatch Unit 1 i
During a procedure upgrade program review, it was determined that the contvol i
room environmental control system air-operated isolation dampers received electrical power for their solenoids from the same power source (Ref. 7),
if the power source fails, the darpers will fail open.
If a high chlorine con-centration is present outside the air intake at the same time that the dampers have failed open, the control room would not be isolated as required. Similarly, if either of the chlorine monitors failed during a LOCA, the dampers would close and prevent pressurization of the centrol room as required by design. Thus, t
two single failures were identified that could defeat the emergency ventilation system for these events.
L t
Limerick Unit 1 l
During a maintenance activity, the control room ventilation system inlet and cu*.let isolation valves had been blocked closed and the control room toilet room exhaust fan was lef t in operation which caused the control room atrosphere to be negative with respect to the adjdent turbine enclosure (Ref. 8). A negative control room pressure is outside of the design basis for control room habitability under adverse conditions.
If the toilet room exhaust system had beer. isolated, the negative control room pressure would not have developed.
Seabrook Unit 1 During a surveillance test, it was roted that the radiation monitors in one of two air intake ducts did not actuate the emergency ventilatiot system (Ref. 9).
It was detennined that the control logic had not been anred since the previous surveillance test.
The "anning" process is fairly complicated and consists of:
1 close manual air intake valve 2
reset ventilation isolation switches 3
open the manual air intake valve open and then closed 4
open the manual air intake valve in addition, there was no control room indication of the condition of the logic circuit so the operators could not ronitor its condition, l
i Sequoyah Unit 1 During a surveillom test, it was noted that the emergency ventilation system could be defeated by a single failure (Ref.10).
In a control room isolation i
actuation, the nomal pressurization fans continue to supply a reduced amount j
of unfiltered air to the lower floors in the control building, while the emergency ventilation system supplies filtered air to the control room to maintain it at a positive pressure. A malfunction in the controller of the operating nomal pressurization fan could result in the pressure in the lower i
floors of the control building exceeding the pressure in the control room and thus producing inleakage.
In addition, it was noted that a failure of the normal pressurizing fan suction damper in the closed position could result in negative pressure in lower floors in the control building.
Excessive outleakage from the control room in this senario would preclude adequate pressurization of the control room in its emergency ventilation mode.
Sunner Unit 1 The licensee determined that a loss of instrument air could cause loss of control r)om ventilation jef. 11).
Each inlet damper has an air actuator, normally operated by instrument air, and an air accumulator and check valve to l
vep the dampers open in the event of loss of instrument air.
It was determined that the check valves were designed to fully seat under a much greater pressure than that of the instrument air system. Consequently, there is no assurance that the dampers would be actuated under design basis conditions because of lack of positive isolation of the non-safety grade air system.
Turkey Point, Unit 3 The licensee determined that a single failure in a power transfer switch could defeat the emergency ventilation system (Ref. 12). The temperature control circuit for the cuntrol room is powered from one motor control center, which is temporarily de-energized after a loss of offsite power. Upon loss of power from this motor control center, a transfer switch changes power sources.
If the transfer switch fails to transfer, no control circuit power would be avail-able and all control room air conditioning compressors and air handlers would be disabled. Loss of these components would result in inadequate assurance that the control room environment could be maintained.
Vogtle, Unit 1 The licensee identified a design problem that could preclude pressuriration of the control room as required by design (Ref. 13). When an emergency ventilation mode is actuated and both trains start, the system provides the control room with cooled, filtered, recirr:ulated air as designed.
If one of the trains then loses power, all dampers fail "as-is."
In this situation, two potential bypass flowpaths are created which would reduce the intake of outside air needed to pressurize the control room. One path would be from the supply header back through the failed train to the suction of the running train. Another path would be from the return header through the Yailed trains ducts to the suction of the running unit. The effect of the bypass flow would be a reduction of the control room pressure below the design value,
Clinton, Unit 1 During a surveillance test, it was determined that the control room ventilaticn makeup fan was producing less than the required flow rate because the fan was rotating in the reverse direction (Ref. 6). This fault was caused by motor lead reversal during a maintenance activity.
Prior to relanding the motor leads, a question as to whether two of the wires should be reversed was discussed between the electrical technician and quality control inspector.
These individuals concluded that the "as found" condition was incorrect as recorded on the maintenance form and agreed to reverse the leads causing them to be landed incorrectly. The leads were subsequer.tly corrected and the fan ficw rate met the technical specification value.
4 ANALYSIS AND EVALVATION Errergency ventilation systems incorporate several comon features to achieve their design requirements.
Pressurization capability inhibits the ingress of unfiltered air into the control room under accident conditions. A small finite amount of air is drawn from the outside through filters to maintain adequate pressurization relative to whatever is surrounding the control room.
In many instances, the adjacent areas may be the turbine building or the auxiliary building whose environment may also be affected by the same ventilation system.
Becmse of the ccmplicated air duct configurations, it may be possible to pressurize the adjacent area outside of the control rcom and thus promote unwanted inleakage under certain upset m ditions.
Six of the events cited were daficiencies that would preclude meeting design criteria given a single failure. The deficiencies, surmarized in Table 1, were discovered in several ways.
Three of the events occurred because of specific coritrol room ventilation studies looking for problem areas. Of these, one was an NPC inspection, one was the result of a analysis of a an earlier system failure, and one was uncovered because of an AE notification of a problem at another plant.
Of the remaining three, one was uncovered during a procedure review, ore during a surveillance activity, end the third was found after a component failure in a different plant system.
Because of the variety of deficiencies observed and the various ways in which they were discovered, it is difficult to judge the extent of additional undetected problems in the control room ventilation system at other plants or even at the plants cited above.
Except for one of the events, the specific defects were not readily apparent unless one was carefully reviewing the system.
It is not apparent that TPI Action Plan item !!! D.3.4 required a determination uf whether the emergency ventilation system met single failure criter S n as required by GDC 19 of Appendix A to 10 CFR Part 50.
Consequently. (ontrol room habitability analyses and reviews performed about six years ago may not have looked for these types of deficiencies. However, the ongoing study vf Generic Issue 83 has performed several independent plant reviews and ident' ied substantial deficiencies in system performance as indicated'in Information Notica 86-76 (Ref.14). The root causes of these design deficiencies are unknown, however, that should not deter other licensees from correcting similar deficiencies at their plants.
. Table 1.
Design Deficiencies Problem Connent Single air inlet damper Does not meet single failure (U.S. NRC Inspection Report criterion for isolating air intake No. 50-315/87002) for a toxic gas event.
Control of norwal operating Malfunction in the controller to ventilation system reduce speed of the operating (LER50-377/87-039) normal pressurization fan could result in unwanted inleakage from areas surrounding the control room because of higher pressures in these areas.
Airline check valves Missized check valve in instrument (LER 50-395/87-019) airlines defeats backup air bottle needed to actuate isolation damper on loss of instrument air.
Dampers on same power supply Dampers fail open on loss of power (LER50-321/87-004) which would preclude pressurizing control room following an accident and loss of a single power train.
No backdraft dampers lack of backdraft dampers would (LEp50-424/87-044) preclude pressurizing control room because of backflow through idle or failed ventilation train.
Single power transfer switch Failure of a single power (LER50-250/86-040) transfer switch would defeat all control circuit power and thus disable all air conditioning compressors and air handlers in the control room ventilation tystem.
l
9-Operational errors caused another group of emergency ventilation system failures, that persisted for varying lengths of time. Three of the events involved mispositioned or blocked dampers which would have precluded pressurizing the control room.
In one case, the mispositioning of one damper was sufficient to defeat control room pre.,surization under accident conditions (2 weeks exposure), in another' case, the mispositioned damper defeated only one train of emergency ventilation (would not meet single failure criterionover2monthperiod). These operational defects were attributed to inadequate procedures which failed to clearly specify criteria for the damper positions.
In one instance, a subsequent surveillance test caught the problem, but in the other, surveillance tests did not prompt corrective action.
A third case of mispositioned dampers involved a short terin maintenance activity where both inlet and outlet dampers were blocked closed and the toilet room exhaust fan left running so that excessive uncontrolled leakage into the control room occurred. The licensee subsequently installed differential pres-sure sensors to alert the control room staff to improper ventilation conditions.
This event was attributed to inadequate procedures which were also changed.
The automatic isolation circuitry was not "armed" at one plant for about one month. Complicated procedures and lack of feedback indications in the control room were the reasons given for this extended deficiency in the emergency ventilation system.
In another situation, a technician and a 0/A inspector agreed to (incorrectly) reverse the leads on a ventilation fan following a main-tenance activity, thus, defeating the fan output. This impromptu action degraded the ventilation system for three weeks before it was discovered.
These operational events generally reflect inadequate administrative control coupled with inadequate feedback cancerning the status of the ventilation system.
Single failure criterion, design reviews, cuality assurance program, and technical specifications for the emergency ventilation system are generally comparable to the treatment of other safety systems.
However, over a relatively short period of time, significant flaws have been observed in these ventilation systems at about 10 percent of the operating plants.
Inadequate control room emergency ventilation could impair the operating staff so that recovery from an ongoing accident is imperiled by potential' loss of the operators. Not all events that foul the environment around the plant pose catastrophic conditions for control room personnel.
Slow evolving events pro-vide time for operator response to correct malfunctioning eouipment such as isolation dampers,1" the operator is aware of the need to perform such an action. On the other hand, toxic gas accidents may evolve rapidly and overcome the control room staff if the automatic operation of the emergency ventilation is not working properly. Thus, it may not be prudent to rely on operator action in these situations as was proposed in a number of the LERs.
From a safety standpoint, these design and operation deficiencies in the control ventilation system constitute a significant reduction in safety margin because the operators are affected.
5.
FINDINGS AND CONCLUSIONS l.
Control room emergency ventilation systems have complicated designs that are supposed to isolate or pressurize the control room relative to its 4
surrounding
- under severe accident conditions.
i
2.
The ability to isolate and/or pressurize the control room assuming a single failure has teen compromised by design flaws at several plants.
3.
Operational deficiencies and maintenance activities have also degraded the control room ventilation system of a number of plants for extended periods of time.
4.
The complicated ventilation designs appear to be prone to oversights, either design or operational, that can go undetected by the control room staff because of insufficient feedback on the system status.
c,--
- --,,- - - ~, -- -. -
l 6.
REFERENCES 1.
"Clarification of TMI Action Plant Requirements," NUREG-0737, November, 1988.
2.
J. Boland et al, "Survey of Licensee Control Room Habitability Practices,"
NUREG/CR-4191, April, 1985.
3.
U.S. Nuclear Regulatory Commission, Inspection Report No. 50-483/87035, Callaway Plant, Unit 1. November 24, 1987.
4.
Licensee Event Report 85-042, Docket 50-315, D.C. Cook, Unit 1, September 30, 1985.
5.
U.S. Nuclear segulatory Commission, Inspection Report No. 50-315/87002, 50-316/87002, D.C. Cook Nuclear Power Plant, October 23, 1987.
6.
Licensee Event Report 87-038, Docket 50-461, Clinton Power Station, July 23, 1987.
7.
Licensee Event Report 87-004, Docket 50 321. Hatch, Unit 1, May 15, 1985.
8.
Licensee Event Report 85-017, Docket 50-352, Limerick, Unit 1, February 22, 1985.
9.
Licensee Event Report 87-016 Docket 50-443, Seabrook Station September 18, 1987.
- 10. Licensee Event Report 87-039, Docket 50-327, Sequoyah, Unit 1, August 7,
- 1987,
- 11. Licensee Event Report 87-019, Docket 50-395, Sunter Nuclear Station, August 27, 1987
- 12. Licensee Event Report 86-044, Docket 50-424, Vogtle, Unit 1, September 18, 1987 14 U.S. Nuclear Regulatory Commission, IE Information Notice No. 86-76:
"Problems Noted in Control Room Emergency Ventilation Systems," 509 August 1986.
1 1
1 INFORMATION NOTICE NO.: 86-76 Supplement 1 Problems Noticed in Control Poom Emergency Ventilation Systems Addressees:
All nuclear power reactor facilities holding an operating license or a construction pemit.
Purpose:
IE Infomation Notice 80-76 provided general infomation to the addressees about problems with control room emergency ventilation systems noted at the Trojan Nuclear Plant and at several other plants visited by an NRC review team. This supplement catalogs specific single failures and other deficiencies in control room ventilation systems that have been reported in licensee event reports or other reports.
Recipients are expected to review the infomation provided for applicability to their facilities and consider actions, if appro-priate, to preclude the occurrence of similar problems at their plants.
However, suggestions contained in this information notice do not constitute NRC requirements; therefore, no specific action or written response is required.
Discussion:
A number of events regarding deficient control room ventilation systems have been reported at different reactor sites.
These events were situations where the ventilation system would not satisfy the single failure criterion, because of either basic design flaws or continuing operational oversights. A sumary of the specific problems is presented below:
Problem Coment Single inlet air damper Does not freet single failure (U.S. NRC Inspertion Report criterion for isolating intake No. 50-315/8700'!)
air for a toxic gas event.
Control of nornal operating ventilation Malfunction in the controller system to reduce speed of the nonnal (LER 50-327/870.19) operating pressurization l
fan could result in unwanted inleakage from areas surrounding the control room because of higher pressures in these areas.
Airline check valves Missized check valve in (LER 50-395/87-019) instrument air lines fails to seat and thus defeats back-up air bottle needed to actuate isolation damper on le:: of instrument air.
2 Problem Coment Dampers on same power supply Dampers fail open on loss of (LER 50-321/87-004) power which would preclude pressurizing control room following an accident and loss of a single power train.
No backdraft dampers Lack of backdraft dampers (LER 50-424/87-044) would preclude pressurizing control room because of back-flow through idle or failed ventilation train.
Single power transfer switch Failure of a single power (LER 50-250/86-040) transfer switch would defeat all control circuit power and thus disable all air conditioning compressors and air handlers in the control room ventilation j
systs.
Dampers set in wrong positions This would prevent pressuriz-(LER 50-315/85-042) ing control room under accident conditions.
l Automatic isolation circuitry This would severely compromise not amed operator protection, especially (LER50-443/87-016) during a toxic gas accident.
The unavailability of the control room emergency ventilation is a significant reduction in the safety margin at a plant. Although sorr.e would argue that time is available for operator action to correct a fault in the ventilation system, the failures may not be recognized and/or the time available may not be sufficient to take action especially during a toxic gas accident.
No spe-cific action or written response is required by this infomation notice.
If you have any questions about this matter, please contact the technical contact listed below or the Regional Administrator of the appropriate regional office.
Charles E. Rossi, Director Division of Operational Events Assessment Office of Nuclear Reactor Regulation Technical
Contact:
Sanford Israel, AEOD (301)492-4437
_