ML20202H746

Safety Evaluation Accepting Licensee Position That Correction of AC-11 Single Failure Vulnerability Unncessary

ML20202H746
Person / Time
Site:	Millstone
Issue date:	12/10/1997
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20202H700	List: ML20202H694 ML20202H729 ML20202H746
References
NUDOCS 9712100352
Download: ML20202H746 (5)

Text

_ _ _ _ - _ _ _ _ _ . - - _ - _ _ _ _ _ _ _ _ - _ _ _ - _ - - - _ - _

\* .

~

Attachment i i

SAFETY EVALUATION CONTAINMENT SYSTEMS AND SEVERE ACCIDENTS BRANCH DIVISION OF SY3TEMS SAFETY AND ANALYSIS

1.0 INTRODUCTION

In a licensee event report LER) dated September 11, 1995 Northeast Nuclear Energy, op(erator of the Millstone Nuclear (LER 94-040-02),

Power Station, submitted information describing the Decembar 6,1994, discovery of a

" deficiency in the original design' of the Unit 2 facility. The design deficiency relates to potential single failure scenarios that could have resulted in an unfiltered fission product release path from the Enclosure Building in the event of a Design Basis LOCA coincident with Enclosure Building purging operations.

2.0 DISCUS $10N 2.1 ENCLOSURE BUILDING AND ASSOCIATED SYSTEMS M111 stone-2 is a dual-containment PWR facility. The primary containment is a

-large, dry, prestressed concrete structure that encloses the Nuclear Steam Supply System. It is designed to withstand peak accident pressures and temperatures with very low leakage (i.e., 50.5%/ day for the first 24 hrs and 50.25%/ day after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). The primary containment, penetration rooms and ESF spaces;tre enclosed by a steel-framed, wtal-siding secondary containment fission product control structure called the Cnclosure Bu11 ding. The Enclosure Building is-designed to contain the leakage (except for 4 limited amount of leakagewhich (0.55/might day)escape primaryvia containment certain bypass leakage pathways identified in the Technical Specifications). The Enclosura Building provides a means for the non-bypass leakage tc be directed to and treated by the Enclosure Building Filtration System (IBFS).

The EBFS is a safety-grade, redundant filtration system, each train having a fan, HEPA dampers.= / charcoal filter bank, haating elements, iactwork, and isolation In the event of an accident, the EBFS establishes and maintains a negative pressure in the Enclosure Building, filters the exhaust flow, and discharges the filtered affluent to the Unit I stack. The analysis of i radiological consequences of a Design Basis LOCA assumes that a -0.25'w.g.

negative pressure is established, and filtration begins, one minute after the accident segins (Ref: 'SER dated May 10,1974). During normal operation the EBFS may be used-in conjunction with the CEBPS (described below) for containment radiological cleanup. During fuel ht,ndling the EBFS serves as an emergency ventilation system for the fuel handling area.

The M111 stone-2 dual containment system is also provided with a Containment and Enclosure Building Purge System (CEBPS). The CEBPS consists of a supply fan, glass fiber filter train,-associated supply ductwork and air-operated isolation valves. Another systen, the main ventilation exhaust system, serves as the normal exhaust pathway for the CEBPS. The CEBPS is normally not in use during plant operation, but is used as necessary to reduce primary or  ;

9712100352 971210 PDR P ADOCK 05000336 PDR

_l

• secondary containment airborne radiatica icials for personnel accesc (e.g.,

=600 hrs /yr.). This is done in conjunction with the EEFS. With the exception of containment penetration isolation provisions, the CEBPS ar.d m in-ventilation funaions. system are not safety-grade and do not provide accidentm' itigation It is noted that during the early PSAR design stage there was no CE8PS.. Instead, there were two separate purge supply fans, one,for the i primary containment and one for the Enclostce Building (Ref: PSAR Fig 9-9).

The Enclosure Building was de:igned as a seismic structure. Howevwr, certain Enclosure Building penetrations were originally de:igned and installed to non-seismic devices. criteria and were not provided with single-failure proof isolation It is also notou that the Enclosure Building was not designed with double-door personnel accesses (Ref: Licensee letter dated November 21, 1977). In 1977 the Enclosure Building design basis was clarified and certain penetrations were upgraded to seismic status (Ref: NU let'.or dated March 1, 1979).

Attachment 1 of the LER statrs that the Enclosure Building was not part of the 1973 Millstor.e Unit 2 design. Although ti t Enc'osure Building may not have been incir ded as part of the initial Mll'estone 2 design, it was a planned fission product control feature at least as early as the February 26, 1969, the date of issue of the Preliminary Safety Analysis Report which mentions the ,

Encicsure Building in its Section 5.1.

The enclosed figure depicts the functional arrangement of the systems described above.-

2.2 SINGLE-FAILURE-VULNERABILITIES 2.2.1 SINGLE FAILURE CRITERION A detailed discussion of use of the " Single Failure CMterion" as a deterministic design and analysis tool is provided in SECY-77-439 of August 17, 1977 (NUDOCS 7812180291). Simply stated, it is a requirement that a system designed to perform a defined safety function be capable of performing that function in spite of the failure of any single component within the system or within any associated support system. The Single Failure

. Criterion is codified in Appendices A and K to 10 CFR 50. The SFC is also invoked in various Code and Standards. Appendix K specifies requirements for ECCS systems whereas Appendix A identifies general staff review criteria applied to all systems important to safety. For primary containment isolation systems, GDC 55, 56, and 57 identify specific acceptable redundant valve arrangements that encompass Os single-failure criterion. However, applicability of these GDC to secondary containment isolation systems is not discussed in the Regulations.

Since the SFC and GDC-are not expressly invoked in the Regulations for application to secondary entainment penetrations, they are ' requirements" cnly to the extent that they were used and documented as design and licensing criteria during the facility's Construction Permit and Operating License acceptance reviews. ,

9

=. ..

s 2.2.2 MILLSTONE 2 SINGLE FAILURE VULNERABILITIES In 1994, several Enclosure Building isolation system single-failure I vulnerabilities were discovered by the licensee and reported to the NRC.

which is not discussed in this evaluation related to the hydrogen analyzerOne, cabinet hood vent. The others relate to penetrations used dur'ng containment purging. -

Of the single failure vulnerabilities rela'.ed to purging, the first relates to safety-related air operated damper AC-1 which is controlled from the Unit 2 main control board. AC-1 is designed to close upon initiation of a Channel #1 Containment Isolation Actuation Signal (CH1-CIAS). It lacks a second solenoid that would enable it to automatically close on a CH2-CIAS. A CH1-CIAS actuation also causes startup of EBFS exhaust fan F-25A. In the event of a LOCA or MSLB during purging, with failure of actuation signal CHl-CIAS, damper AC-1 weuld fail to close and fan F-25A would fail to start. This combination of lack of isolation (AC-1) and reduced filtered exhaust capability (loss of one train of exhaust / cleanup) would pravent the secondary containment from

functioning properly as a fission produce cleanup system for primary contain-ment leakage as the single operating F-25 fan would not have sufficient capacity to establish and maintain the necessary negative pressure in the unisolated Enclosure Building.

The second damper AC-11.single failure vulnerability involves air operated main exhaust If c1 accident should occur during power operation while the Enclosure Building is being purgad and AC-11 fails to close (due to either a mechanical failure or failure of CH2-CIAS), the main exhaust fans F-34A/B/C, would have a direct: suction on the Enclosure Building atmosphere and could cischarge unfiltered primary containment _1eakage to the Unit 2 stack.

These scenarios were overlooked during the original operating license review.

Although the licensee claims that corrective action is not required by the original licensing basis, a modification has been proposed to eliminate the AC-1 vulnerability. A gravity damper would be installed as shown in the drawing.

It would be weighted such that operation of purge fan F-23 opens it, but

-open.:

a -0.25w.g. vacuum due to operation of an EBFS fan would not cause it to This action would eliminate the AC-1 single failure condition.

For the AC-11 vulnerability, no corrective modification is proposed by the licensee, based on (1) insufficient safety benefit and (2) the lack of a licensing basis requirement for single failure reliability. The staff attempted to determine from record documer.ts whether single failure was indeed a licensing requirement for acceptance of the M111 stone-2 Enclosure Building.EBFS design. From a review of eacly docket records, it was determined that the staff performed an extensive review of secondary containment isolation system and clearly accepted the licensee's decision to-reclassify vales AC-3 and AC-B from fail-closed to fail-open on the basis that should AC.-1 or AC-11 fail to close, the Enclosure Building would never-theless perform as designed (Ref: Utility responses to OL Review Questions 5.63 and 6.15.40). However, there is insufficient record information available as to whether such single failure reliability was or would have been considered necessary for the enclosure Building during purging of the

Enclosure Building. In view of this uncertainty, imposition of a corrective action requirement should be considered a backfit action.

3.0 NEED FOR BACKFIT CORRECTIVE ACTION The licensee and staff have given due censideration to the 7robability and consequences of the AC-Il accident scenario. The fact that the vulnerability exists only during purging of the Enclosure Building reduces the probability of occurrence by at least an order of magnitude. The fact that the potential release path is monitored for radioactivity provides a high degree of confidence that manual action would be quickly taken to terminate the releace by shutting off the main ventilation exhaust fans. Existing plant procedures prescribe the necessary actions. Based on these considerations, the staff l

' accepts the licensee's position that correction of the AC-11 single failure vulnerability is unnecessary. It is also noted that the licensee has perforned an Integrated Safety Assessment Program cosf -benefit analysis for l

correction of the AC-11 deficiency and determined that the potential safety benefit is insignificant.

4 l

Principal Contributor: W. Long Date:

. _ . _ . . , .. .. . . . . . .- ~ . . . . ~ . . . . . . . . . . . - . . . . . . - . - ~ . . . . . . . - . . . . . . . . - - . . - .

G I . .

Enclosure l

't 88 Wit a . O meneer

• • casaiseen dk 44 IMI l

, g , - ..,. . .~ n -=

%=' ' ns%

s y -

-cust*

• ou.csas EDWAlm 4

. - n_

m ,

w

=..

EEFS 4,4,,

g. g F se g Ag 9se-

.... ... -.. ... pc

\30 FIGURE - MILLSTONE 2 DUAL CONTAINMENT SYSTEMS

.