05000390/LER-2017-007

LER-2017-007, Multiple Unreported Potential Loss of Safety Function Events Associated with Inoperable Single Train Systems Due to Misinterpretation of Reporting Guidance

Watts Bar Nuclear Plant, Unit 1
Event date:	06-09-2017
Report date:	11-03-2017
Reporting criterion:	10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material 10 CFR 50.73(a)(2)(v), Loss of Safety Function
3902017007R01 - NRC Website

LER 17-007-00 for Watts Bar, Unit 1, Regarding Multiple Unreported Potential Loss of Safety Function Events Associated with Inoperable Single Train Systems Due to Misinterpretation of Reporting Guidance

ML17220A314
Person / Time
Site:	Watts Bar
Issue date:	08/08/2017
From:	Simmons P Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LER 17-007-00
Download: ML17220A314 (10)

es3cr:i carries are iiVY.;mor,-rel imo The li,:Fnsiru pr;..cesF. 'ed sack a; i,d.ist.y. Send co

• nrroillt; ro,:ard'ig Circe r cs: mate Ihc. InkmEtix SeN ces Eval:;11-2 I-13).

VVashil!i.oq. DC 2'..S.H:Ez..)0:: . ri-'11Ei to 11::.coie.:ts.ko3ova6rc.gz.:v. aid 1: De:i, Cffic e..... ,fce of Ir'ornd':iol and ::

• eg..ilak.ry NECE-102C2 :3

• 15C-0'0"-; Ofr.:e o' ',1,9na.jemert art:: E.rtget. Washilgtol. DC 205(:.3. If a meaws L,C.0 U: impose an ir:crna:io- i d::es nct  :.yrreitly Of,16 1.n.bbr 1.1e may rot colcu.::: :y spomy. anc a person is rot req.lired reEpoTi Is the infcrma!or co lec Jon.

3. LER NUMBER

007 - 01 2017

I. PLANT OPERATING CONDITIONS BEFORE THE EVENT

Watts Bar Nuclear Plant (WBN) Unit 1 was at 76 percent rated thermal power (RTP) . WBN Unit 2 was in Mode 5.

II. DESCRIPTION OF EVENT

A. Event Summary On June 9, 2017. Watts Bar Nuclear Plant (WBN) personnel determined that the reporting requirements of 10 CFR 50.72(b)(3)(v) and 10 CFR 50.73(a)(2)(v), as clarified by guidance in NUREG-1022. Revision 3. were being incorrectly applied for certain events associated with single train safety systems. When events occurred that resulted in these systems not meeting Technical Specification (TS) Limiting Conditions for Operation (LCO) for these systems, the short duration of these events relative to their required action completion time, coupled with prompt return to allowable values. were not considered a loss of safety function by Operations and Licensing personnel. As a result, multiple potential loss of safety function events were not reported as required.

This event is being reported to the Nuclear Regulatory Commission (NRC) under 10 CFR 50.73(a)(2)(v)(C) and (D) as an event or condition that could have prevented fulfillment of a safety function needed to control the release of radioactive material and to mitigate the consequences of an accident.

B. Inoperable Structures. Components. or Systems that Contributed to the Event Various equipment issues and personnel errors did contribute to the events described in Section VIII of this report.

C. Dates and Approximate Times of Occurrences Date Time Event (EDT) 3/13/17 N/A Condition Report (CR)1273873 generated for Potential Failure to Report Loss of Safety Function 6/09/17 N/A Extent of Condition for CR 1273873 completed for period of 3/17/14 to 3/17/17. This review incorrectly concludes no failure to report.

6/22/17 N/A Condition Report 1310096 generated to address position on loss of safety function reporting. WBN licensing determines that multiple examples of failure to report have occurred and that the event/discovery date for reporting is 6/09/17.

D. Manufacturer and Model Number of Components that Failed During the Event Not applicable.

Estirded birder be' resnr)oE.e t:. r:crir:1!: :viii h*. irallatr:ry recik

• st: boirs Rep.sled egf...7s .eamed the

• ir.enFilg proces,. -rd 'er! iridt.s7y. .r.end x.roments repwc rg nircen estimate tc; the Inforrlaiol F.erviceT, Esmnr.1- (T-2 F43: U.::: kii..(iat Relt.latr:r rrrevi r . Nashioptor DC 211F:E5 3r by e-real to ard t.: the nftice of Irtrmdbn are' Recu dory Affairs C.fti:%e (7: 1%fanrir:eTenr. V,IaFlingtoo, DC 205'.V.. If rreans iger. inbr,se does ir..t d spay 1 circrrly v3Ic '7A,11 corer..1 number fae ,,11;:C.. my rot cordi..Ct To

• 151:',, .lrf: Peron oD: fe.Sr0-1:: to. toe n'orriar

3. LER NUMBER

2017 - 01 007

E. Other Systems or Secondary Functions Affected

No other systems or secondary functions were affected.

F. Method of discovery of each Component or System Failure or Procedural Error The failure to report these potential loss of safety function events was discovered during an on-going evaluation of this issue by WBN licensing personnel with assistance from other offsite licensing personnel who had been involved in the development of NUREG-1022 Revision 3.

G. Failure Mode and Effect of Each Failed Component Individual failures for each event are summarized in Section VIII.

H. Operator Actions

No operator actions were required at the time, as there were no on-going events.

I. Automatically and Manually Initiated Safety System Responses Not applicable.

III. CAUSE OF THE EVENT

A. The cause of each component or system failure or personnel error, if known.

The cause of the failure to report was an incorrect understanding of the regulation associated with events or conditions that could have prevented fulfillment of a safety function.

B. The cause(s) and circumstances for each human performance related root cause.

The cause of the failure to report was an incorrect understanding of the regulation associated with events or conditions that could have prevented fulfillment of a safety function in addition to the individual human performance and equipment failures attributed to each event.

IV. ANALYSIS OF THE EVENT

When events occurred that resulted in single train systems not meeting TS LCO requirements; the short duration of these events relative to their required action completion time were not considered a loss of safety function by Operations and Licensing personnel. During evaluation of this issue; with input from offsite sources, WBN licensing personnel became aware of a letter transmitted by the Nuclear Regulatory Commission (NRC) staff to Exelon Corporation in January 2015 that provides an NRC position on loss of safety function related to single train type systems. This resulted in a reassessment of those events that should have been reported as a potential loss of safety function, considering the guidance of NUREG- 1022 that a report is required when:

Fr7111F.Pd ner ..e5.pf.,r -o coa-py v..7"1 riarcat:...ryi7d1Pc,on recit..est: hours. Repoled carrel are ircopkyated - re 2rkref:

• .s aid fed Las:4: to ndus7y. Send I tril

• ar estimate to the Irf:-.rmatkr:r Erarci F4.3: S. Nt.r.:1,..ya Rec;u;at,.:ry IC 23555

• 01. or cy e-mai Infc,s.cllects.Resoirc.e@nrc 1ov ;31)C 70 the Cusk Off c.a.'. Offic

  e Rec.ilabry r.FCSR 15202. (.1150-0124). Office Maragenert Fulqet. VVashing,.7.r Dfl If a .te.ar..; need to irir.oF..= iforriafirs does rot di.7.211y a .-.iirer

  y

  valid CMS rtyrbe-. the kr.:(S; Tay rcv1 t:-..c:rd ct Or a pe':::;-.1 k not remmed to ,er..pold :c. the

3. LER NUMBER

2017 - 01 007 "1) there is a determination that the SSC is inoperable in a required mode or other specified condition in the TS Applicability, 2) the inoperability is due to one or more personnel errors, including procedure violations: equipment failures; inadequate maintenance: or design, analysis, fabrication, equipment qualification, construction. or procedural deficiencies, and 3) no redundant equipment in the same system was operable.

Reassessment using these criteria identified a number of events related to single train systems. WBN had not reported events related to Refueling Water Storage Tank (RWST) {EIIS:TK} level. shield building {EIIS:NH} pressure being outside TS limits, containment pressure being outside TS limits, and the control room envelope {EIIS:NA} being inoperable due to a boundary door {EIIS:DR} inadvertently left open. Each event is described in Section VIII of this report. WBN's assessment of the safety impacts of these events is provided below.

1. With respect to RWST level, three events occurred where the RWST level went below the TS 3.5.4 allowed value. While the level was below that permitted by the TS, the level reduction was very small with respect to the tank volume. The safety function capability of the tank was determined to have been met for design basis events (DBEs).

2. The WBN containment design includes a free standing steel pressure vessel surrounded by a reinforced concrete shield building. The shield building is maintained at a negative pressure during normal operation by non-safety related ventilation systems required to be in operation in Modes 1 -4. In the event of an accident. safety related ventilation systems would filter the exhaust from the shield building, reducing the offsite dose to members of the public from postulated leakage of the containment pressure vessel. On multiple occasions. the pressure in the shield building went outside of TS 3.6.15 allowable limits as a result of equipment failures. While these events are reportable as a potential loss of safety function. evaluation of these events shows that the safety function capability of the shield building, the containment pressure vessel. and the associated ventilation systems would not have been lost. The Emergency Gas Treatment System (EGTS), which would function to filter the exhaust from the shield building, is capable of performing its safety function assuming the shield building is not at a negative pressure as documented in the dose analysis in the UFSAR. In addition. such testing or equipment malfunctions also has impacted containment pressure TS 3.6.4 which specifies the relative pressure limits between the containment and the annulus. The design of the containment pressure vessel bounds any minor pressure transient that may occur during ventilation system transients and its safety function capability would not be lost.

3. The control room envelope (CRE) is required to be operable in Modes 1 through 6. Operability requires integrity of the control room envelope such that it will have a low unfiltered inleakage during accident conditions to maintain the dose to operators within the requirements of 10 CFR 50, General Design Criterion 19. TS allows the CRE boundary to be opened intermittently under administrative control, normally to allow personnel ingress and egress from the control room. Administrative controls in the case of boundary doors are that an individual is in control of the door when it is opened. On multiple occasions, personnel entering and leaving the control room left one of the boundary doors open. This resulted in operations personnel entering TS LCO 3.7.10, Control Room Emergency Ventilation System (CREVS), Condition B for one or more CREVS trains inoperable due to an inoperable CRE boundary. Low positive pressure (less than 0.2 inches of water gauge (WG)) in the control room for 90 seconds results in a control room alarm. Upon receipt of the alarm, operations personnel promptly closed the CRE door. For these events. the time that the CRE boundary was open was approximately four minutes for each event.

including the alarm delay time. The licensing basis at WBN for a loss of coolant accident (LOCA) assumes instantaneous core damage and release, and therefore, a potential loss of safety function event for each case occurred. The physics of such an event are that core damage and a containment release would take some period of time much greater than a few minutes. The CRE door would be expected to be closed with high confidence well in advance of an actual radiological release. Most of the door events involved the door being ajar, and under these circumstances simplified. non-surveillance testing has shown that a positive control room pressure would be present.

V. ASSESSMENT OF SAFETY CONSEQUENCES

The failure to report potential loss of safety function events represents a significant concern from a regulatory standpoint. A review of these events indicate. when considering the actual system capability and the response of equipment and personnel, a loss of safety function capability impacting public health and safety did not occur with respect to the RWST. Shield Building. Containment or the Control Room.

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event Availability of systems to perform the required functions is described in Section IV.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shutdown the reactor and maintain safe shutdown conditions. remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident Availability of systems to perform the required functions is described in Section IV.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from the discovery of the failure until the train was returned to service The time period that systems and equipment were outside of specified TS limits is described in Section VIII of this LER.

VI. CORRECTIVE ACTIONS

This event was entered into the Tennessee Valley Authority (TVA) Corrective Action Program and is being tracked under Condition Report (CR) 1310096.

A. Immediate Corrective Actions

Upon determining that previous events were reportable. this LER was initiated and developed for submittal. Communication of this reporting issue has occurred within operations and licensing.

B. Corrective Actions to Prevent Recurrence or to Reduce Probability of Similar Events Occurring in the Future WBN will brief personnel, including supplementary staff. on the regulatory and nuclear safety impacts related to failure to close the control room boundary doors, and will post door watches as needed.

NRC FORM ..u'; Page L,1

• 1 ,ra:.?:.f blIrd01 r'e' '(-N;::1 .D6 1:: ccrl:;!y veh this mardatcri ..-7.110.7.11:T rentsl: .H, hours Rep7rterl ie.,:iow Ica.nid are iroxp:;ryled ilto .le Iher si-ig process arc fP, buck to .r.:(1112tiy Serd comrici :_ re:jadrc oJidei ostimle. :5 the ilfomOio-i Sery see Braln (T-2 .7,1.3) 1.J.S 1,3; ear LICENSEE EVENT REPORT (LER) ,.!*:ii,tvy c.-,,,,,issia Oidn rr.;-ori. DC 2(15FA):)

• or  :-.‘, E rail to 11 CONTINUATION SHEET ,t,c01x'. '4.osourcofrir:.:.gN Jr .d :.:: Ih:e D:,., C...7'c.e. :dce cl Irt

• -:11E101 ,ild P.eulao-y 4Iair:T riLL)B-1;.:202. (31:',0-01:.4). Office c."dana.genen- alri .1 get. Wasl- ingfol. DC. 2C502. .f a means -,.., L.,:ed to rrpo.:,:: en ilfo'l IL-Ala, L!.Ilec.i:r. (ice:, not display a c,:

• rently .,al; U3 curl's,) 'lumber the td-'.I.; Tay T.)! L,.:n(JJ::1 ci s:):2:1;,::.r. a1. a rer3on is rrA Tri.ii'el :o reword Is tin irfoernat.or c.II(:;:ti:T Watts Bar Nuclear Plant, Unit 1 05000390

VII. PREVIOUS SIMILAR EVENTS AT THE SAME SITE

On November 11. 2015. WBN Unit 1 failed to enter TS 3.1.8 Condition A which was required when WBN Unit 1 experienced a rod drop event. This was subsequently reported to the NRC as a condition prohibited by TS in LER 390-2016-007 on June 20, 2016. This event is similar in that licensing personnel incorrectly interpreted requirements related to how to comply with TS 3.1.8.

VIII. POTENTIAL LOSS OF SAFETY FUNCTION EVENTS FOR PREVIOUS THREE YEARS

A summary of potential loss of safety function events over the last three years is provided below:

Events related to TS LCO 3.5.4 for the Refueling Water Storage Tank less than 370,000 gallons Date Time Condition I Summary Report 3/24/14 0435 864251 Entry into TS LCO 3.5.4.6 when level in the RWST went below TS minimum of 370.000 gallons with Unit 1 in Mode 4. Exited LCO when Unit 1 entered Mode 5 at 0620 on March 24. 2014. Due to other equipment issues, a decision was made to use the RWST to provide a Reactor Coolant System (RCS) makeup water source during 7/7/14 1255 907544 Entry into TS LCO 3.5.4.B when level in the RWST went below TS minimum of 370,000 gallons. A leak from the suction side of the Refueling I I Water Purification Pumps was isolated and the Unit 1 RWST was refilled. 1 I— The LCO condition was exited on July 7. 2014 at 1320. I 6/5/16 1230 1317307 Entry into TS LCO 3.5.4 Condition B when level in the RWST went below TS minimum of 370,000 gallons due to a reactor trip with safety injection I (SI) on WBN Unit 2. Exited TS LCO 3.5.4 Condition B on June 5, 2016 at 1 1622 when the RWST was above TS minimum level. The trip with SI J was reported to the NRC in LER-391-2016-004 on August 4. 2016.

Events related to TS LCO 3.6.4 for Containment Pressure outside range of greater than of equal to -0.1 psid and less than or equal to +0.3 psid relative to the annulus ._ Date Time Condition Summary Report 1 7/14/16 1307 11317307 I Entry into TS LCO 3.6.4 condition A when the containment pressure was ,

• I less than -0.1 psid relative to the annulus following the loss of power to the I 1 annulus vacuum fans. TS LCO 3.6.4 Condition A was exited on July 14, 1 2016 at 1354. This was subsequently determined to not be reportable i because this occurred during a planned evolution performed using L 1 approved flant procedures.

3/13/17 1558 1273873 Entry into TS LCO 3.6.4 condition A when the containment pressure was less than -0.1 psid relative to the annulus during Auxiliary Building Gas I Treatment Condition System (ABGTS) Pressure Test of Train B. TS LCO 3.6.4 A was exited On March 13, 2017 at 1613.

NRC, FORM

lerCCOS ewed are rcc:D:,r:Heci Vito fIF: li;er 6rig r::!7e:,s a.-11 fed b:rk iy;,istry. Se-1::

nrriRr-5 -ecornirci ti.rceri eqmate to :'ie Inforrnatim ..iervice;. F!'anc'i CI 2 -/.3). U S. Ni.clea, R.,,,,,i,,,,, c.:now.,.:icr ,Na,:ai.rtol. Dr. Co2"):':5!-: u"1. cr 4 F- 'rail Irfo:::ollctc.';:esc.,..ircearr:-. - .p. ard t.-. file D.,, )f :re-. C.. o' :ifoTao-1 and 7‘e.gill2tor f lki-s.

r.:[(-n io2o,3, (3

• !:..)0':)4) C,IThe of ;

• lanageriert ann P.Itet. Washirgtol. 7.:C, 2ff:03. 9 -1- a.ts uf;ed to impos--J ai into-Taton cz.1,c,-,ior dce; pr..t xd.:1!.. a c.i.rrelt .y.,,ai:: OVE coitro

• nurroe

• . the t..,!(.; may lz.-.  ::c,rdt.c.1 cr spols:y, and a N.-an is rot rF,:rived to re,,perid to II-e inforra7ion :::-.1o:::Ibil

3. LER NUMBER

2017 - 007 - 01 Events related to TS LCD 3.6.15 Condition B for annulus pressure requirement not met for the Shield Building. SR 3.6.15.1 requires annulus to be greater than -5 inches WG with respect to atmosphere Date 3/12/15 Time 1 1133 Condition Resort 998890 i , i Summary Entry into TS 3.6.15 Condition B for annulus pressure not within limits (more negative than -5 inches WG) due to dropping below -5.5 inches VVG because 1-FC0-65-49 Annulus Vacuum normal control damper not controlling_properly. Annulus pressure restored at 1305.

9/13/15 1025 -t 1317307 Entry into TS 3.6.15 Condition B for annulus pressure not within limits due to pressure transient from initiating an Auxiliary Building Isolation (ABI) for U2 testing. LCO 3.6.15 was exited at 1031. This was subsequently determined to not be reportable because this occurred during a planned evolution performed using approved plant procedures.

6/2/16 1512 1177619 Entry into TS 3.6.15 Condition B for annulus pressure not within limits due to failure of 2-FC0-65-45 to open during 2-SI-99-303-B. Exited LCO 3.6.15 at 1518.

6/5/16 1240 —El 317307 Shield building pressure less than -5 in WG due to U2 Reactor Trip with SI. Exited condition at 1242 on June 5, 2016. The trip with SI was reported to the NRC in LER-391-2016-004 on August 4, 2016.

i 3/1/17 3/13/17 t _ _ , 1558 -71272164/ 1272224 Shield building pressure less than -5 in WG due to Loss of Power Power Ascension Test (PAT). TS LCO 3.6.15 Condition B not entered into plant logs. Exited condition at 1438 on July 14, 2016 when annulus pressure was greater than -5 in WG. This was subsequently determined to not be reportable because this occurred during a planned evolution for power ascension performed usinlapproved plant procedures.

Entry into TS LCO 3.6.15 Condition A and B for annulus not more negative than -5 inches WG due to transient caused by storm front moving through area. Exited TS LCO 3.6.15 Condition A and B on March 1, 2017 at 1446.

Shield building pressure less than -5 in WG due to ABGTS testing (No entry into LCD 3.6.15 Condition B logged). Exited condition at 1812 on March 13. 2017.

Events related to TS LC(} breached) Note: The control room ' Date 1 Time I (Alarm) 3.7.10 for the Control pressure alarm comes Condition Report Room Emergency Ventilation System (CRE boundary in after a 90 second delay.

, Summary 3/23/14 ' 0424 862708 Boundary door closed by 0427 3/30/14 0951 866226 Boundary door closed by 0953 5/31/14 0157 894134 Boundary door closed by 0159 t-- 6/14/14 6/23/14 0915 1135 899633 Boundary door closed by 0917 903067 I Boundary door closed by 1140 7/10/14 1 1255 ,._7/11/14 1 1014 909000 910194 Boundary door closed by 1257 Boundary door closed by1016 lessons learned are incorporated into tie licensing process and fed back to industry. Send comments regarding burden estimate to the Information Services Branch (T-2 F43). U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mal to Infocollects.Resource@nrc.gov, and to the Des;( Officer. Office of Information and Regulatory Alia rs, NEOB-10202, (3150-0104). Office of Managemem and Budget. Washington. DC 20503. li a means used to impose an informatior collecton does not display a currentiy valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection

3. LER NUMBER

2017 007 01 .

Date Time ±Alarm) Condition Report Summary 7/19/14 0822 912154 I Boundary door closed by 0823 8/22/14 1740 1317307/1326447 Boundary door closed by 1743 8/23/14 2240 1317307/1326447 Boundary door closed by 2246 10/21/14 0708 948571 Boundary door closed by 0710 11/7/14 1722 1317307/1326447 Boundary door closed by 1725 12/15/14 1245 967964 Boundary door closed by 1247 1/18/15 0703 979264 Boundary door closed by 0705 2/3/15 1305 985860 Boundary door closed by 1306 2/8/15 0726 986637 Boundary door closed bL0727 2/11/15 0603 988464 Boundary door closed by 0605 3/15/15 1242 1000413 Boundary door closed by 1244 3/25/15 1924 1317307/1326447 Boundary door closed by 1925 6/15/15 1502 1040054 Boundary door closed by 1504 7/21/15 1918 1317307/1326447 Boundary door closed by 1922 7/22/15 2100 1061510 Boundary door closed by 2103 8/18/15 0427 1071973 Boundary door closed by 0429 10/13/15 0751 1092726 Boundary door closed by 0753 10/31/15 0240 1099526 Boundary door closed by 0242 10/31/15 1358 1099592 Boundary door closed by1360 11/14/15 0728 1104089 Boundary door closed by 0731 12/5/15 2207 1112234 Boundary door closed by2210 1/4/16 1053 1121123 Boundary door closed by 1055 1/22/16 0332 1127775 Boundary door closed by 0334 1/22/16 2247 1128181 Boundary door closed by 2250 1/26/16 0550 1129073 Boundary door closed by 0552 1/26/16 2005 1129477 Boundary door closed by 2007 2/15/16 1102 1137634 Boundary.door closed by 1104 4/20/16 1827 1162773 Boundary door closed by 1830 4/27/16 2334 1317307/1326447 Boundaryclosed by 2337 - door 5/12/16 2134 1170567 Boundary door closed by 2141 6/29/16 1951 1187273 Boundary door closed by 1954 7/30/16 0404 1197627 Boundary door closed by 0406 10/21/16 1409 1225143 Boundary door closed by 1412 3/20/17 0120 1274363 Boundary door closed by 0122 3/21/17 0900 1275203 Boundary door closed by 0902. The Control room door was undergoing minor maintenance. Maintenance personnel were in control of the door during this activity.

4/6/17 1620 1281767 Boundarypor closed by 1623 5/13/17 1408 1295376 Boundary door closed by 1410

IX. ADDITIONAL INFORMATION

None.

NRC FORM 2.66A (04-2017) Page 8 of _9_, infocollects.Reseurce r@nrc.gov, and to the Desk Officer, Office of Irforrnation arid Regulatory Affairs, used to impose an information collection does not display a currently said OMB control numoer, NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

2017

3. LER NUMBER

007 - 01

X. COMMITMENTS

None NW; FORM '366A 104-20171 Page