05000220/LER-2012-003

LER-2012-003,

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(v), Loss of Safety Function
2202012003R01 - NRC Website

L DESCRIPTION OF EVENT

A. PRE-EVENT PLANT CONDITIONS:

At the time of discovery, Nine Mile Point Unit 1 (NMP1) was operating at 100 percent of rated thermal power. Operation of NMP1 was unaffected by the event since, with the reactor in the power operating condition, the shutdown cooling (SDC) system is not in operation and the motor-operated valves that isolate the SDC suction line from the reactor recirculation system (IV 38-01 and IV 38-02) are closed and de-energized.

B. EVENT:

During plant shutdown periods with the SDC system in service, both suction line isolation valves (IV 38-01 and IV 38-02) have typically been open and de-energized, in accordance with the system operating procedure. The purpose of this SDC system alignment was to prevent inadvertent or spurious closure of the isolation valves and the resultant interruption of the shutdown cooling decay heat removal function. However, in this alignment, the ability to isolate the SDC suction line (a safety function required by Technical Specification (TS) Section 3.2.7, Reactor Coolant System Isolation Valves) is defeated, as both isolation valves are incapable of closing in the event of a low-low reactor water level due to a leak in the SDC system.

During the NMP1 forced outage which began on September 20, 2012, the SDC system was in service with both suction line isolation valves (IV 38-01 and IV 38-02) open and de-energized, in accordance with the system operating procedure. The loss of safety function and potential reportability of this condition were not recognized by the operations staff during the forced outage. On October 18, 2012, as a result of discussions between Operations and Licensing staff members and management, a determination was made that operation with both SDC isolation valves open and de-energized was a reportable condition in accordance with 10 CFR 50.73(a)(2)(v)(D) as an event or condition that could have prevented fulfillment of a safety function needed to mitigate the consequences of an accident, because both of the SDC system suction line isolation valves were incapable of closing in the event of a low-low reactor water level due to a leak in the SDC system.

Within the last three years, there were additional shutdown periods when the SDC system was in service with both suction line isolation valves open and de-energized. These were a forced outage in July 2012, a forced outage in February 2012, a forced outage in May 2011, the refueling outage in March/April 2011, and a forced outage in November 2010.

TS Section 3.2.7.f allows continued plant operation with both SDC system suction line isolation valves inoperable provided either: (1) immediate action is initiated to suspend OPDRVs; or (2) immediate action is initiated to restore the valve(s) to operable status. However, while the SDC system suction line isolation valves were inoperable during the September 2012 forced outage, an operation with the potential for draining the reactor vessel (OPDRV) was initiated when the bottom head drain valves were opened for reactor vessel water inventory control. Since neither of the two actions were taken, an operation prohibited by TS existed and is reportable in accordance with 10 CFR 50.73(a)(2)(i)(B).

There was no impact on Nine Mile Point Unit 2 from this event.

THE EVENT:

Both of the SDC system suction line isolation valves (IV 38-01 and IV 38-02) were open and de-energized, thereby rendering their isolation function inoperable. There were no other inoperable structures, systems, or components that contributed to the event.

D. DATES AND APPROXIMATE TIMES OF MAJOR OCCURRENCES:

Sept. 20, 2012 NMP1 scrams on low reactor water level (addressed in a separate LER).

@ 09:23 Sept. 20, 2012 Cold shutdown conditions are achieved.

@ 19:25 Sept. 21, 2012 Both SDC suction line isolation valves (IV 38-01 and IV 38-02) are de- energized in the open position. @ 00:52 Sept. 22, 2012 Power to both IV 38-01 and IV 38-02 is restored, and the valves are declared operable. @ 09:45 Oct. 18, 2012 It is determined that operation with both SDC suction line isolation valves open and de-energized is a reportable condition in accordance with 10 CFR 50.73(a)(2)(v)(D). Condition Report CR-2012-009540 initiated.

@ 13:00

E. OTHER SYSTEMS OR SECONDARY FUNCTIONS AFFECTED:

None

F. METHOD OF DISCOVERY:

The determination that SDC system operation with both suction line isolation valves open and de-energized was a reportable condition was made as a result of discussions of the condition and associated reportability criteria between Operations and Licensing staff members and management following the September 2012 NMP1 forced outage.

G. MAJOR OPERATOR ACTION:

None. No operational conditions requiring operator action occurred as a result of the determination that SDC system operation with both suction line isolation valves open and de-energized was a reportable condition.

H. SAFETY SYSTEM RESPONSES:

None. No operational conditions requiring the response of safety systems occurred as a result of this event.

II. CAUSE OF EVENT:

In March 2009, the SDC system operating procedure was revised to add instructions for defeating and restoring the SDC system isolation function. The purpose of these changes was to enhance nuclear safety by preventing inadvertent or spurious closure of the isolation valves and the resultant interruption of the shutdown cooling decay heat removal function by de-energizing the valves in the open position. The procedure was thought to be in accordance with the requirements of TS Section 3.2.7.f, which allows continued operation with both of the SDC system suction line isolation valves inoperable provided there are no OPDRVs in progress. As explained in the Bases for TS Section 3.2.7, operation with the SDC system in service is not considered an OPDRV so long as system integrity is maintained, meaning that the SDC piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the SDC system. What was not recognized was that implementation of the procedure change allowed placing the system in a configuration that resulted in a reportable condition. Since 2009, the procedure has been periodically implemented during outage periods.

The apparent cause of having a procedure initially put into place that, when implemented, resulted in a reportable condition due to purposely defeating a TS-required safety function is that Operations personnel involved in the procedure development did not recognize the need for, or coordinate, reviews from other key station stakeholders. There was a mindset by those involved that the procedure change was acceptable because it enhanced nuclear safety (from a preservation of decay heat removal perspective) and was permitted by TS. As a result, no cross-disciplinary reviews of the procedure change were performed by other station stakeholders. A contributing cause is that training on the requirements of 10 CFR 50.72 and 10 CFR 50.73 did not adequately prepare Operations personnel to recognize the reportable condition.

1 In addition, it was not understood that the reference to OPDRVs in TS Section 3.2.7.f was not limited to SDC system flow paths only but, rather, included any ongoing OPDRV, and it was not initially recognized that maintaining reactor vessel water inventory by use of the bottom head drain valves constituted an OPDRV. The apparent cause of this knowledge deficiency is a failure to implement the change management process, which resulted in the station not fully assimilating the NRC guidance provided in Enforcement Guidance Memorandum (EGM) 11-003, Revision 1, "Dispositioning Boiling Water Reactor Licensee Noncompliance with Technical Specification Containment Requirements during Operations with a Potential for Draining the Reactor Vessel" into existing processes.

This event was entered into the Nine Mile Point Nuclear Station corrective action program as condition report numbers CR-2012-008756, CR-2012-009540, and CR-2013-003479.

-

III. ANALYSIS OF THE EVENT:

The SDC system suction line isolation valves perform both a reactor coolant system isolation function and a primary containment isolation function. The purpose of this function during shutdown conditions is to isolate the SDC system from the reactor coolant system to mitigate the loss of reactor coolant inventory in the event of a leak that breaches the SDC system boundary. A loss of reactor coolant inventory could lead to a loss of decay heat removal for fuel in the reactor pressure vessel. The loss of the isolation function is reportable in accordance with 10 CFR 50.73(a)(2)(v)(D) as an event or condition that could have prevented fulfillment of a safety function needed to mitigate the consequences of an accident. In addition, failure to take the actions required by TS Section 3.2.7.f when the reactor vessel bottom head drain valves were opened (an OPDRV) during the time that the SDC system suction line isolation valves were inoperable is reportable in accordance with 10 CFR 50.73(a)(2)(i)(B) as an operation or condition prohibited by TS.

There were no actual safety consequences associated with this condition. Reactor vessel low-low water level initiates the automatic closure of the SDC isolation valves. NMP1 did not experience any conditions that would have required the SDC system to be isolated to preserve reactor coolant system inventory. Additionally, the NMP1 SDC system is a closed loop system with the sole purpose of removing decay heat absorbed by the reactor water during shutdown conditions. Unlike later vintage boiling water reactors, the NMP1 SDC system does not have multiple operating modes or cross-connections to other systems. As a result, the NMP1 SDC system is not subject to system misalignments that could cause a reactor coolant inventory reduction event. Based on these considerations, it is concluded that the safety significance of this event is low and the event did not pose a threat to the health and safety of the public or plant personnel.

This event affects the NRC Reactor Oversight Process (ROP) Performance Indicator (PI) for Safety System Functional Failures (SSFF) because the event could have prevented fulfillment of a safety function needed to mitigate the consequences of an accident. There were three instances of the SDC system in service with both suction line isolation valves open and de-energized in the last four calendar quarters; however, Nine Mile Point did not realize that a problem existed until after the September 20, 2012 forced outage. Therefore, the NRC performance indicator for SSFF is projected to rise from 0 to 1 at the end of the fourth quarter 2012. The threshold from Green to White for this PI is 6, and the PI will remain green.

IV. CORRECTIVE ACTIONS:

A. ACTION TAKEN TO RETURN AFFECTED SYSTEMS TO PRE-EVENT NORMAL STATUS:

1. The SDC system operating procedure has been revised to remove the section that contained the instructions for defeating and restoring the SDC system isolation function.

B. ACTION TAKEN OR PLANNED TO PREVENT RECURRENCE:

1. Additional licensed operator training has been conducted regarding application of the reportability criteria of 10 CFR 50.72 and 10 CFR 50.73, with an emphasis on events or conditions that could prevent fulfillment of a safety function (10 CFR 50.72(b)(3)(v) and 10 INRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION

CONTINUATION SHEET

Nine Mile Point Unit 1 05000220 2012 003 01 l CFR 50.73(a)(2)(v)).

2. The NMP1 and NMP2 refueling procedures and reactor water cleanup system operating procedures will be revised to more specifically incorporate the OPDRV definition and associated guidance relating to OPDRVs that is provided in NRC EGM 11-003, Revision 1.

3. Lessons learned regarding use of the change management process as it applies to plant operating procedure revisions have been communicated to procedure sponsors.

4. Lessons learned regarding OPDRVs and the guidance contained in NRC EGM 11-003, Revision 1 have been communicated to Operations management and Operations training personnel.

A. FAILED COMPONENTS:

There were no failed components that contributed to this event.

B. PREVIOUS LERs ON SIMILAR EVENTS:

None C. THE ENERGY INDUSTRY IDENTIFICATION SYSTEM (EIIS) COMPONENT FUNCTION

IN THIS LER:

IEEE 803 COMPONENT IEEE 805 SYSTEM

IDENTIFICATION COMPONENT IDENTIFIER

Shutdown Cooling System Isolation Valve N/A BO

D. SPECIAL COMMENTS:

None