ML20029C209

LER 91-003-00:on 910219,both Trains of Control Room Ventilation Sys Inoperable.Caused by Design Malfunction & Management Deficiency.Temporary Modifications,Removing Automatic Closure Function implemented.W/910321 Ltr

ML20029C209
Person / Time
Site:	McGuire
Issue date:	03/21/1991
From:	Mcconnell T, Sipe A DUKE POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LER-91-003-02, LER-91-3-2, NUDOCS 9103260441
Download: ML20029C209 (8)

Text

.- .. 11 l Duke krr Cwnpany (704pn.mm ,

AcGwre Nuclear Stoiwn 12M Hagm ferry M> art Huetmntle, AC: Mig &985 DUKE POWER March 21, 1991 U.S. Nuclear Regulatory Commission Document Control Desk Washingtont D.C. 20555

Subject:

McGuire Nuclear Station Unit I and 2 Docket No. 50-369 Licensee Event Report 369/91-03 Gentlement Pursuant to 10 CFR 50.73 Sections (a)(1) and (d), attached is Licensee Event

. Report 369/91-03 concerning both trains of the Control Room Ventilation system being inoperable because of a Design Deficiency. This report is being submitted in accordance with 10 CFR 50.73(a)(2)(v) and (a)(2)(vii). This event is considered to be of no significance with respect to the health and safety of the public.

Very truly yours, r} A f tCw T.L. McConnell DVE/ADJ/cb1 Attachment xc: Mr. S.D. Ebneter Mr. Tim Reed Administrator, Region II U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Ccmmission Office of Nuclear Reketor Regulation 101 Marietta St. , NW, S' ate 2900 Washington, D.C. 2055'S Atlanta, GA 30323 Mr. P.K. Van Doorn INPO Records Center NRC Resident Inspector Suite 1500 McGuire Nuclear Station 1100 circle 75 Parkway Atlanta, GA 30339 M&M Nuclear Consultants 1221 Avenue of the Americas New York, NY 10020

)

9103260441 910321 \ ;/ y i

[ PDR ADOCK 05000369 3 PDR y/ l )

. . - . - . - . . . .. .~ - . . . . . . . . , . - x .,

alC f eein Jae U S NU:;4t&E Kt0VLAt02, COMwtssON

) . AFPIOYt0 0%89 ko l'094 os

, . LICENSEE EVENT REPORT (LER) E pials e st a

.(CiLivv =A.f m wcal e =vun a ai .. a 4 McGuire Nuclear Station, Unit 1 oisio;o;oi 36;9 i do,j j 7

"'*Both Trains Of The Control Room Ventilation System Were Inoperable Because Of A Desien Deficiency And "fanacement Deficience tythT oaf t sti LtR Nuwata 46 AleOmi Da f t Ifi Of wt a f acettfits inevotvt0 its WONTw DAv vtam vtaa $N U .'" $*M v0%f CAv 'IA* i . = ' r N avt s Doc a t f %vvetie s:

McGuire Unit 2 o ,5, o , o , o ; 3,7 j0 0l2 1l9 01 9l1 0 l0l3 0 l0 0l3 2 l1 9l1 o,5,o,n,o, , ,

Ort mattees.

This AEPO41 #1 SutnslTTEO PUR$UANY 70 f.et agovialutNil Os to C8 8 % 'C*ece sae e *es* ** **e de *** *p' li t t "006

• I 20 eolm a sosi.i no rawaa i i n n..

n i. win.i u s...im y w ri..ian.,

r o i ...

(10s j l 20 408aaHt1841 94 34ieH21 to 13*e4219een ofwtA $sec *

• As e.

to 73 enttid 20 40GleH1Het

} to 73.eu2u.auas ass 4i n ,mi .

y a is..ntne, w ...la r. n.,

to 406ieH1Het SC 72ieH24.el N 73ieu2Has LDCSSti CONT ACT 80A THIS LI A ttli

%AMt flLEP=ONE %.vele AmtACQQt Alan Sipe, Chairman, McGuire Safety Review Group 7;0;4 87 i j 5, i4 ,1,8 3 i COM*Lif t ONE Limt 804 E ACM COMPO%t%t # AILue t Ot tc A'et 0 e4 TMit a spont 1931 CAEst tilf t v Cou'%i' ' NN$# "',h( n'(( C Avst sv1?tv CoveONtNY "'%

y C n

le a

1 i i I i ! __ l , I I I I i i l i I I I I I I I  ! I i l I l SUP9Llut%f AL At>On t t a'f CTIO 414 90NY= 34, ytA9 Svtw 5$ ION

,il #f res ee-peeve f pfC7f0 $US4HS3sO% CA Tri NO g g l AS$7 A ACT / Led so 7400 aparat e e escre.aete'r Mte#4 sme e taeve troematte* per (18e On February 18, 1991,- Design Engineering (DE) personnel were performing a review of Nuclear Station Modification (NSM) MG-52065 to examine recommended additions to the NSM package. During the course of the' review, DE personnel reevaluated the fact that loss of non-essential electrical power to chlorine detectors and radiation monitors associated with the Control Area Ventilation (VC)-system would cause the Outside Air Intake Isolation valves for the VC system to close and that they could not be reopened from the Control Room.

It was then determined that compensatory actions in place could not be achieved within the timing requirements for the assumptions of the Control Room dose analysis. Subsequently, at 2140, on February 19, 1991, both trains-of the VC system were declared inoperable and Technical Specification (TS)

Action statement 3.0.3 was entered for both units. A temporary modification was initiated to remove the automatic closure function from the radiation monitors and chlorine detectors. Also, changes to the procedures for responses to high chlorine or radiation alarms were initiated. At 0245, ou February 20, the modification,and procedure changes were completed and TS Action Statement 3.0.3 was exited. Unit I and Unit 2 were in Mode 1 (Power Operation) at 100 percent power at the time the event occurred. This event is assigned a cause of Design Oversight and a contributing cause of Management Deficiency. Appropriate modifications and procedure changes will be implemented to resolve the problem.

l

4'-

' 88800. foem'JesA U S 8:UCLI AR KitVLA10RY COMadiggiog 4 ., LICENSEE EVENT REPORT (LER) TEXT CONTINUATION - ePaovgoove,8o me.o m (IPtAtt l'31'ge f aCativ_ mAmet tu Docutti hvMesa tai tan NUmsta te pact (si

• • • a " W.W' 'n*.O

[McGuireNuclearSStatior a Unit 1 o ls jo j o lc l3 l 6l9 9l1 0l 0 l3 0l0 l2 or l7 3 rmno, . wei am m, j

EVALUA. ION:

Background

There + wc independent trains of the-VC [EIIS:VI] and Chilled Water (YC)

[EIIG:KL systems which are designed to maintain a habitable environment in

~

the Centrol Room [EIIS:NA) during normal and accident conditions. Based on the-hab.tability requirements as defined in the Final-Safety Analysis Report (FSAR) criteria,=the systi_m is designed as an Engineer.3 Safeguards features

[EIIS:JE] systeu with absolute and carbon filtration (EIIS:FLT]-in the outside air intakes and with equipment redundancies for use as conditions require. The Control Room is designed to be maintained at a positive pressure of >/= 0.125 inches water gauge (w.g.), relative to outside i atmospheric pressure during an accident to prevent entry of contaminants.

~Two.100 percent capacity Outside Air Pressure Filter Trains pressurize the

~

-Control Room by providing approximately 2000 cfm of filtered outside air.

TS Bases'3/4.7.6, VC system, states, in part, that t M operability of the VC system ensures- that the Control Room will remain habitable .for Operations personnel duringLand following all credible accident conditions. The operability of this system in conjunction with. Control Rcom design provisions  :

is based on limiting the radiation exposure to personnel occupying the Control Room to 5 rem or less whole body, or its-equivalent. This limitation is- consistent with the requirements of General Design Criterion 19 (GDC-19) of - Appendix A, Code of Federal: Regulations, Title 10, Part .50 (10 CFR 50).

FSAR Section 15.6.4.3, Environmental Consequences for Loss-Of-Coolant 1 Accidents, Control Room Operatoc Dose, states, in part,- that the l maximum postulated dose to a Coatrol Room 0perator is determined based on the.

releases of a Design Basis Accident.' The offsite radiological consequences are . calculated based on certain assumptions and parameters. ::hich include that-the unfiltered.inleakage into the Control Room is 10 cfm.

- The- VC Lsystem has two outside air intake structures [EIIS:NN] for each train.

-Each structure is monitored by a Radiation Monitor (EIIS: MON] for the presence of radiation and has two redundant isolation valves [EIIS:ISV).

When a radiation signal:is received by either Control Room Outside Air Intake

Radiation Monitors,1 EMF-43A or 1 EMF-43B, the intake which is the source of

-contamination automatically closes. Should both intake.s close, the operator will override the-ir.ake radiation monitors and by inspection of.the Control-Room readouts, opra the-unit intakes with least radiation. This will ensure

_ pressurization u the Control Room at all times. i

-Chlorine Detectors [EIIS:DET] monitor the outside air intake structures of the VC system for the presence of chlorine gas. Each structure is monitored by one detector and has two redundant isolation valves. If gas is detected by either detector of the train, the train intake structures will be automatically secured by means of closing four intake isolation valves and a local / remote alarm [EIIS: ALM] will be generated. The major parts of a l

I g,.. . . .m .. m . n... m .s. -

i A Pesim teu V 4 WUCLt13 K4IM&TDaV C0heMiGS g ,

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION unovic om wo om.ow

. nets sv a Tatigin e.ame i , botas,wuneogn638 te n huuste it

• Act ist yo "GP ?M,7; McGuire Nuclear Station, Unit 1 olsjolojol3lt,9 9l1 0l0j3 O;O l3 os l7 mi e . wc wu. ein chlorine detector are the electrolyte tank (Ells:TK] that houses a wick, a blower [ Ells:BLO) unit, and an electronic unit.

Description of Event In March of 1989, Self Initiated Technical Audit (SITA) 89-02 (MC) of the VC system was conducted at McGuire. During the course of this audit, it was found that the single failure of a non-essential electrical circuit for the chlorine detectors associated with the VC system will render the system inoperable by causing all e.ight outside air intake isolation valves to close.

L e closing of these valves will prevent pressurization of the Control Room which is in violation of TS requirements. Also, 10CFR50, Appendix A, j Criterion 24, requires that a safety related system be protected from the effects of a single failure. The results of the investigation conducted at the time of the finding stated the following:

1. Root Cause(s) for the_ findings:

At the time the Chlorine Detectors were purchased for McGuire, safety related detectors were unavailable. Chlorine protection wo considered a non-safety function and McGuire was licensed with non-nafety chlorine detectors.

Anytime non safety instrumentatics ic used to control a r efety component, a failure mode on loss of power to the non-sa'ety instrumentation must be selected. In this case, the VC _ntake valves close on loss of power to the chlorine detectors. Although this presents a problem be:ause outside air would not be available

• for pressurizing the Control Room, closing the valves is the safe position for chlorine. protection. Failing the intake valves closed is preferable to allowing them to remain open and potentially allowing radiation or chlorine into the Control P.oom. i For an optimum design, the chlorine de'.ectors for each intake should be powered by separate power supplies. This would add reliabilita by preventing both intakes from closing on total loss of non-safety power.

In summary, the present design meets separation criteria and provides for proper failure of the safety valves on loss of non-safety power. However, the control circuit could have been

\ optimized by powering the chlorine detectors from separate power supplies. This is not considered a violation of the single failure criteria, and root cause is not an issue.

2. Scope & results of the investigati_on performed to determine the extent of the finding:

Procedures are in place at McGuire to reopen the VC air intake valves. These procedures were followed on October 12, 1989 (see

.e , o.. m. .,x

. m . , .

1. M Pere 3084 W 8 touCLif.3 ESIVLATOAV COM.H9 80su g ,

LICENSEE EVENT REPORT (LEM) TEXT CONTINUA.fl0N Awaovio ove =o me-o*

en ines e se.

uciun .= m ma ni wuaia m is. vv.inii ews a,

.... **mp 7;.g McGuire Nuclear Station, Unit 1 0 jal0l0lcl3l 6[9 9l1 -

0l 0l 3 -

01 0 l4 or [7 nu u . - , =ac wou.mn

'.J. ? 369/89-31), and the valves were reopened. This LER was written as c, rer it of a blown fuse in the chlorine detector circuit which causeG the intake valves to close. Station personnel feel that thesu procedures are adequate to address this issue. (Reference PIR 0-M89-0270.)

3. Corrective steps which have been taken and the results achieved:

As a result of LER 369/89-31, Station Problem Report (SPR) No. 2989 was written by station personnel to separately fuse each chlorine monitor. Implementation of this SPR will prevent a reoccurrence of the proble.n identified in the LER; however, the following additional changes should be made for increased reliability:

a, Power the chlorine detectors associated with each intake from separate non-safety power supplies.

b. Revise control circuitry to allow the bypass of the radiation monitors and chlorine detectors during maintenance.

At the tie.e of this evaluation, no further corrective actions were deemed necessary.

In January.of 1991, Operations (OPS) personnel began an evaluation of the compensatory actions requ' ired by OPS personnel in emergency situations. A concern had been raised because of the number of actions required. As a result, OPS petsonnel generated 4 memorandum to Project Services and DE personnel requesting a reevaluation of the need for a procedure response requiring OPS personnel to reopen the VC system air int ske valves.

' Consequently, a meeting was held between OPS, Project Services, DE, and Mechanical Maintenance personnel to discuss the problem. Personnel involved decided to ask for a further thange to be made to NSM MG-52065 deleting some of the automatic closure signals from the chlorine detectors and radiation monitors. This would simplify the compensatory actions required by OPS personnel.

On February 18, 1991, DE personnel began a review of NSM MG-52065. The ,

purpose of-the review was to examine the' proposed recommendations for change from a safety standpoint. As a result, the fact that loss of non-essential power to the chlorine detectors or to the radiation monitors (EMF-43A and 43B) the VC system outside air in'.ake isolation valves will close and cannot be reopened from the Control Room was evaluated. This was different than the evaluation performed af ter the finding by SITA Audit 89-02. The previous evaluation had not considered the effect of loss of power to the radiation monitors. Also,-an evaluation of allowahle time for not having the Control Room pressurized had been performed later and had identified only a 20 to 30 second response time for compensatory actions. At this time, it was determined that the compensatory action requiring OPS personnel to open the breaker for each valve and to manually open each valve, may not be achieved

,, o , ,,, 3 ,

. m - +

u e eucosa a.:u6a.on, co so l eama

. UCENSEE EVENT REPORT (LER) TEXT CONTINUATION **=oaco m o>+ co e t Piht 6 6 '3t '15

~

, e ui, . n, o c si u-... m o . ., . . i ., . . . .

ies= ** t% .LGQ McGuire Nuclaar Station, Unit 1 o p l o j o l o l 3 l 6j 9 9l 1 -

0l 0[ 3 -

010 15 of l7 m,, - . cu =4.m within the time requirements for the assumptions of the Control Room Dose Analysis.

On February 19, 1991, DE personnel and OPS personnel determined the VC system might be inoperable and initiated PIR 0+M91-0033 to resolve the problem.

Consequently, at 2140, on February 19, both trains of the VC system were declared inoperable and TS Action Statement 3.0.3 was entered for both units.

Temporary modifications were initiated to remove the automatic action on loss of power irom the chlorine detectors and radiation monitors. Also, changes to the procedures for responses to high chlorine or radiation alarms were initiated.

At 0245 on February 20,.1991, the modifications were completed and appropriate procedure changes were implemented to have OPS personnel close the valves upon a high radiation or high chlorine alarm. Therefore, both traina of the VC system were declared operable and TS Action Statement 3.0.3 was exited for both units.

Conclusion This event is assigned a cause of Design Oversight. At the time the chlorine and radiation monitor circuitry was designed, a failure mode on loss of power was selected in what was considered the most conservative direction. Failing the VC intake valves closed was preferable to allowing them to remain open and potentially allow radiation or chlorine into the Control Room. Although this presents a problem because outside air would not be available N '

pressurizing the Control Room, the intent at the time was considered to be conservative based on available technical information.

A contributing cause of Management Deficiency is assigned because when the SITA Audit detected the problem with the design, the corrective wetions taken were not generic enough in nature to resolve the problem. SPR 2989 was written and approved to seperately fuse each chlorine detector.

Recommendations were also made to power the chlorine. detectors associated with each intake form seperate non-essential power supplies and to revise the control circuitry to allow the bypass of the chlorine detectors and radiation monitors during maintenance. At the time Management personnel involved felt that the procedures in place, requiring ops personnel to reopen the intake

. valves on loss of power, and these proposed modifications were adequate to resolve the problem. This evaluation had not considered the ef fect of loss of power to the radiation monitors nor the evaluation performed later establishing a short 20 to 30 second response time to take compensatory

i action and open the intake valves. Therefore, no further investigation or l

corrective actions were deemed necessary. However, upon a second evaluation l

which included consideration of the allowabe time for not having the Control Room pressurized, DE personnel determined that the compensatory actions in place may not be achieved within the time requirements of the assumptions for the Control Room dose analysis.

l I .

• • 3 an.c roaw w a l - .. __ . . - - . - - - . _ _ - _ .- - __ '

l

.e ... .u vi =vessam anv6avoae co==eo=

( LICENSEE EVENT REPORT (LER) TEXT CONTINUATION waoveo ove =o ves-c+

.+aa e we f ace,4itt haut ns DOC # 41 IdVMDl a til ig n esphegga #g, pagg (3;

'saa " d.L "'A*.T:

Mc0uire Nuclear Station, Unit 1 o ls j o l o j o l 3 ] 6l 9 9]1 - 0j 0l3 -

0l 0 l6 of l7 ein,, . w nac w .nm When the deficiencies were discovered, appropriate actions were taken to delete the automatic isolation function from both the chlorine detectors and radiation monitor 2. Also, appropriate procedure changes were made to ensure that,the appropriate intake valves would be closed upon receipt of a high radiation or high chlorine alarm signal. All appropriate notifications were made when the units entered TS Action Statement 3.0.3. During the time when the VC system was inoperable, OPS Control Room personnel were fully aware of the situation and no events occurred requiring them to take further action.

A review of the Operating Experience Program data base for the previous 24 months prior to this event revealed 3 LERs documenting Design Deficiencies

with the VC system because of a design oversight. Ther.e were LERs 369/89-15, 369/90-10, and 369/89-31. LER 369/89-15 documented a design oversight with respect to the proper reference point for measuring Control Room pressure.

LER 369/90-10-0 documented an unanticipated interaction of systems when the VC system heaters would not operate as designed. LER 369/89-31 documented a design oversight with respect to a similar problem as this LER and the corrective actions taken were not of generic enough nature to prevent this event from occur:ing as determined by further analysis. Therefore, the problem is considered to be recurring.

This event is not Nuclesr Plant Reliability Data System (NPRDS) reportable.

There were no personnel injuries, radiation overexposures, or releases of radioactive material as a result of this event.

CORRECTIVE ACTIONS:

Immediate: 1) Temporary Modifications 6010 and 6011, removing the automatic closure function from the chlorine detectors and radiation monitors were installed as directed by work request 890295.

2) Changes were made to procedures OP/2/A/6100/10N, Annunciator Response For Panel 2AD13, OP/1/A/6100/10R, Annunciator Response for Panel IRAD2, and OP/1/A/6100/10Q, Annunciator Response For Panel IRAD1 specifying required actions for different accident scenarios.

l Subsequent: 1) Procedure EP/1/A/5000/01, Safety injection or Reactor Trip, was changed to specify required actions for different accident scenarios.

Planned: 1) DE and Project Services personnel will evaluate and make permanent changes to the circuits for the l chlorine detectors and radiation monitors involved. l l

1 l

c sonu an* * ' * "- '

1

<= vi auco== neutuoav co-winio=

g~e ., ma 4 ,

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION maovio ove =o mo-me immaw.

. otin ... m ovo n wo=*'a

• u ainv in + eau a

• = "t'#. 3*D McGuire Nuclear Station, Unit 1 o ls jo lo ]o ]3 l 6l9 9l1 __ 0j 0 [3 0l0 l7 or [7 mm .  : _ =ac w m. .nm

2) The previously installed temporary modifications 6010 and 6011 will be removed as directed by work request 890295.

SAFETY ANALYSIS:

The design requirements of the VC system are to supply filtered air at a controlled temperature and humidity to the Control Room and to pressurize the Control Room to prevent inleakage of untiltered air. The VC system helps ensure that doses to Control Room personnel are As Low As Reasonably Achievable and in the event of a ciesign basis accident, the VC system acts to limit Control Room operator dose 0 less than the General Design Criterion 19 limits, i.e., less than 5 Rem whole body or its equivalent. Since whole body doses are primarily due to exposure to noble gases which the filters do not remove, the VC system is not required to ensure acceptable whole body doses.

However, the VC system redures thyroid and skin doses by pressurizing the Control Room with filtered air to minimize unfiltered in-leakage.

The principle contaminant contained in air leaking into the Control Room is assumed to be radioactive Iodine which is very conservatively modeled in dose calculations. Very low amounts of Iodine would be expected to reach the area around the Control Room since this requires passage through either Auxiliary (VA) (eIIS:VF3 or Turbine Building Ventilation systems l't.IIS:VK] or passageways first.

• No credit is taken for the VA filtration, with regard to Control Room dose ,

calculation, in. mitigating the Emergency Core Cooling System leakage source.

However, this system is automatically switched to the filtered exhaust mode of operation on an accident or Blackout signal or if radiation is detected by the exhaust monitor [ Ells: MON). The VA system has four 50 percent capacity trains for Units 7 and 2 which respond to an accident on either unit thus providing essenti G y redundant protection. Operation of the VA system in the filtered exhaust mode by either train of the system would serve to reduce the calculated dose to Control Room personnel.

In the event the Control Room atmosphere became unbreathable, self contained breathing apparatus (SCBAs) provided in the Control Room area could be employed. . Radiation monitors in the Control Room would alert Control Room personnel of high radiation levels.

Both trains of the VC system were technically inoperable but were fully capable of operating.

During the event, there were no accidents that would have required operation of the VC system to maintain habitability of the Control Room.

This event did not affect the health and safety of the public.

l g.g.o.. . ..-m.~..-

.