05000247/LER-2009-004

LER-2009-004, Loss of Single Train 23 Charging Pump Required for Remote Plant Shutdown From the Control Room Due to a Failure of a Pump Internal Check Valve

Indian Point 2
Event date:	6-23-2009
Report date:	8-07-2009
Reporting criterion:	10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor
Initial Reporting
ENS 45152	10 CFR 50.72(b)(3)(v)(A), Loss of Safety Function - Shutdown the Reactor
2472009004R00 - NRC Website

Note: The Energy Industry Identification System Codes are identified within the brackets {).

DESCRIPTION OF EVENT

On June 23, 2009, while at 100% steady state reactor power, at approximately 18:23 hours, control room (CR) operators started the 21 Charging Pump {CB) after observing decreased pressurizer (AB) and Volume Control Tank (VCT) (CB) level due to degraded 23 Charging Pump outlet flow. The 23 Charging Pump was removed from service and declared inoperable due to its inability to maintain pressurizer level. At 18:23 hours, Technical Specification (TS) 3.3.4 (Remote Shutdown) Condition A was entered. The 23 Charging Pump is credited in TS Basis Table 3.3.4-1 for reactor coolant system (RCS) {AB} inventory control. The inoperable 23 Charging Pump results in a failure to meet the specified safety function of TS 3.3.4 and meets the reporting criteria of 10CFR50.72(b)(3)(v)(A) for a condition that could have prevented the fulfillment of a safety function needed to shut down the reactor and maintain it in a safe shutdown condition. At 20:35 hours, an 8-hour non-emergency notification was made to the NRC for a safety system functional failure (EN#45152). The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as CR-IP2-2009- 02376 Troubleshooting for the cause of the 23 Charging Pump degraded capacity was initiated.

The capacity of the pump was degraded by approximately 20 percent. The investigation concluded the 23 charging Pump degraded capacity was a result of failed internal check valve (V) assembly. A review was performed of the history of Charging Pump failures due to internal check valves. The review determined that internal check valve failures have occurred during past operation at Indian Point and other nuclear facilities that use similar equipment. The failures appear to be random based on the following: 1) failures of internal check valves were not confined to a specific location within the pump, 2) internal check valve failures appear to be independent of service life as failures have occurred over a wide range of service life, 3) failure of the internal check valves are independent of the different specified valve materials used. Fatigue life of the material does not appear to be a factor. As a.

result of previous internal check valve failures, the Charging Pump packing procedure (0-PMP-413-CVCS) was enhanced to require inspection of the pump internal check valves for signs of degradation. The enhanced procedure has identified previous early stages of check valve degradation which has allowed corrective actions to be initiated prior to pump capacity degrading to an inoperable condition.

There are three variable speed motor driven positive displacement charging pumps that take suction from the Volume Control System Tank (CVCT) and discharge to the reactor coolant system (RCS) and reactor coolant pump (RCP) shaft seals. The pumping action is produced in a single stage using spring-loaded poppet type suction and discharge valves internal to the pump which act as check valves. Each pump has a capacity of 98 gpm but the normal flow for one pump of 87 gpm is sufficient to supply the RCP seals and charging flow to the RCS. The charging pumps were originally manufactured by Union Pump Company (U055).

The Control Room (CR) {NA} is designed for an unlikely event that the CR becomes inaccessible and operators are required to establish control and shutdown of the plant remote from the CR. The remote shutdown function provides designated equipment at appropriate locations outside the CR with the capability to promptly shut down and maintain the unit in a safe condition in Mode 3. The remote shutdown TS LCO provides the operability requirements of the instrumentation and controls necessary to place and maintain the unit in Mode 3 from a location other than the CR.

Corrective Actions

The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:

• The 23 Charging pump internal check valves were replaced and the pump returned to service.

• Monitoring of the effectiveness of inspections of pump internal check valves (ongoing).

Event Analysis

The event is reportable under 10CFR50.73(a)(2)(v), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (A) shut down the reactor and maintain it in a safe shutdown condition." On June 23, 2009, at approximately at 18:23 hours, operations entered Condition A of TS 3.3.4 for an inoperable 23 Charging Pump. The inoperability of the 23 Charging Pump was recognized as preventing the Technical Specification 3.3.4 (Remote Shutdown) function (TS Basis Table 3.3.4-1, Function 4.c, 23 Charging Pump Local/Remote Transfer Switch) for RCS inventory control. The inoperable single train remote shutdown feature 23 Charging Pump resulted in a safety system functional failure (SSFF). The pump was repaired, tested and returned to service on July 2, 2009.

Past Similar Events

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved inoperable remote shutdown functions. One Unit 2 LER was identified, LER-2009-003. LER-2009-003 reported a SSFF due to a loss of single train 21 Pressurizer Backup Heater required for remote shutdown from the Control Room caused by an inoperable breaker. The inability to reset and re-close the breaker for the 21 pressurizer B/U heater was due to a misaligned control relay trip (anti-pump) lever. LER-2009-003 had a different cause as the misaligned breaker lever was a result of a previous breaker rack-in whereas this LER was due to a failed component.

Unit 3 reported in LER-2008-002 a loss of the single train 31 pressurizer heater.

The unit 3 event was a different cause as that event was due to a failed pressurizer heater transformer.

Safety Significance

This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients requiring shutdown outside the CR. If needed, a 45 gpm orifice can be put into service in lieu of the 75 gpm orifice which would reduce demand to approximately 54 gpm. With the 23 Charging Pump at approximately 80 percent capacity, the use of the 45 gpm orifice would be sufficient to maintain RCS inventory with the degraded 23 Charging Pump. Shutdown outside the CR could also be accomplished with the 21 Charging Pump. Procedural guidance is available for operators to use the 21 Charging Pump (2-AOP-SSD-1, "Control Room Inaccessibility Safe Shutdown Control"). This procedure allows at Shift Manager discretion the use of the 23 or the 21 Charging Pump depending on plant conditions. The 21 Charging Pump is capable of performing the same reactor coolant inventory control as the 23 Charging Pump. Additionally, procedure SOP-ESP-1 is available for starting the 21 Charging Pump at the 480 Volt Switchgear and local capability is available for adjustment of pump speed to maintain RCS inventory.

In accordance with NUREG-0800, Section 7.4, shutdown remote from the CR is not an event analyzed in the USFAR for accident analysis (Chapter 14). Specific scenarios are not specified on which the adequacy of shutdown capability remote from the CR is evaluated. A recognized type of event that could force the evacuation of the CR and the need to shut down remote from the CR is smoke from a fire. Fire damage limits as they impact safe shutdown do not require consideration of an additional random single failure in the capability to safely shut down. Therefore, application of single failure to remote shutdown is applicable only to other events that could cause the CR to become uninhabitable. These events would not result in consequential damage or unavailability of systems required for safe shutdown.