05000247/LER-2010-006
| Indian Point 2 | |
| Event date: | 9-1-2010 |
|---|---|
| Report date: | 10-30-2010 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| Initial Reporting | |
| ENS 46222 | 10 CFR 50.72(b)(3)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 2472010006R00 - NRC Website | |
Note:� The Energy Industry Identification System Codes are identified within the brackets (I.
DESCRIPTION OF EVENT
On September 1, 2010, while at 100% steady state reactor power, Operations performed quarterly test 2-PT-Q017C (Alternate Safe Shutdown Supply Verification to 23 CCP).
Test 2-PT-Q017C verifies: 1) the Component Cooling Water (CCW) (CC} pump is capable of being operated from the alternate AC power supply, 2) Channel checks for Alternate Safe Shutdown Instrumentation: Temperature Indicator TI-5139 Reactor Coolant System (RCS) Loop 21 Hot Leg (HL) Wide Range (WR) Temperature, TI-5140 RCS Loop 21 Cold Leg (CL) WR Temperature, TI-5141 RCS Loop 22 HL WR Temperature, TI-5142 RCS Loop 22 CL WR Temperature. In accordance with the procedure, the Alternate Source Range Monitor Disconnect switch (EDH 7) was closed and channel checks performed for RCS WR HL and CL Temperature Instruments. RCS Loop 21 and Loop 22 CL WR Temperature instruments TI-5140 and TI-5142 tested satisfactorily. RCS Loop 21 and 22 HL WR Temperature instruments TI-5139 and TI-5141 did not meet test specifications. RCS Loop 21 HL temperature instrument TI-5139 indicated failed high and RCS Loop 22 HL temperature instrument TI 5141 indicated failed low. The As-Found test readings failed to meet the procedure acceptance criteria. The Control Room was notified and an assessment was performed that concluded the test results were valid.
Technical Specification (TS) Basis 3.3.4 (Remote Shutdown), Table 3.3.4-1, Function 3.b (Decay Heat Removal via Steam Generators), RCS HL Temperature requires one operable function. The RCS HL Temperature is also credited in Technical Requirements Manual (TRM) 3.3.D (Appendix R Alternate Safe Shutdown Instrumentation). Operations concluded the function for RCS HL Temperature was inoperable and entered TS 3.3.4 Action Statement A.1 and SAO-703 (Fire Protection Impairment Criteria and Surveillance) at 16:00 hours. The event was recorded in the Indian Point Energy Center corrective action program (CAP) as condition report CR-IP2-2010-05446. TS 3.3.4 required action A.1 is to restore the required function to operable within 30 days. SAO-703 required action 9.a.1 is to establish an hourly fire watch tour for areas related to the impacted equipment within one hour, and required action 9.a.2 is to restore the impaired instruments or power distribution and control components to functional status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Work Orders were issued to troubleshoot and repair. On September 2, 2010, troubleshooting was being conducted to support issue resolution. However, no system anomaly was detected and test 2-PT-Q17C was re-performed. The test results were satisfactory with no issues and TS 3.3.4 and SAO-703 actions exited at 16:13 hours.
An historical review of the surveillances and calibrations was performed. The review went back to July 23, 2007 and identified two tests that resulted in unsatisfactory results. One test on October 30, 2008, identified TI-5139 (RCS Loop 21 HL WR Temperature) oscillating. The cause was determined to be a degraded R/I Converter [Temperature Modifier(TM)]. The second unsatisfactory test was on July 9, 2009, when TI-5139 pegged high and was replaced.
The extent of condition review determined the only other instruments that could have been affected are the cold leg temperature indications. However, these instruments passed their surveillance tests and subsequent calibrations.
Cause of Event
The apparent cause was indeterminate. A Failure Modes and Effect Analysis (FMEA) identified two possible causes: PC-1) A test process failure, PC-2) Component failure.
PC-1: Test 2-PT-Q017C has had historical problems regarding the test sequence when the Alternate Safe Shutdown (ASSD) panel was powered prior to the start of the 23 Component Cooling Water Pump (CCP). The 23 CCP starting current had instances of impacting instrument readouts. To mitigate this effect the surveillance test was revised.
Another impact discovered was the need to wait a period of time for the instrument to warm up and stabilize after establishing power. A 15 minute waiting restriction was added to the last test revision in March 2009. Operations confirmed that this waiting requirement was met. A possible cause is the waiting time for instrument warm-up remains too short and additional time will provide better performance.
PC-2: A review of the instrument loop shows the majority of components are common with respect to the power supply such that any failure would have resulted in all four of the TIs failing not just two. The common components are Transfer Switch EDF9, Fuse box EWA19, disconnect Switch EDH7, and SOLA Transformer EBB8. The remaining components are unique to each instrument and consist of an R/I converter (TM) and Temperature Indication (TI). A degraded TM would be expected to cause the TI readout to shift, but not go to zero or peg to a maximum value and remain. A complete failure of the TM could cause the TI to peg high or low, but the successful test the next day ruled out a complete TM failure. Calibration of the instruments is performed on two year frequency in accordance with procedure 2-PC-2Y1. The last calibration was performed on September 17, 2010, subsequent to the quarterly test and all TMs and TIs were found to be satisfactory with the exception of some minor drift on TM-5141 (RCS Loop 22 HL WR Temperature). TI-5141 was unaffected by the as-found drift. The only remaining possible cause is that the TIs became stuck when power was first applied.
Corrective Actions
The following corrective actions will be performed under the Corrective Action Program (CAP) to address the causes of this event.
- Re-perform test 2-PT-Q017C with engineering review.
- Evaluate re-test results and identify any additional actions.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(v)(A), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (A) shutdown the reactor and maintain it in a safe shutdown condition." On September 1, 2010, at 16:00 hours, operations declared the RCS WR HL Temperature Instruments TI-5139 (Loop 21) and TI-5141 (Loop 22) inoperable based on test readings found out of specification. TS Basis 3.3.4 (Remote Shutdown), Table 3.3.4-1, Function 3.b Decay Heat Removal via Steam Generators, RCS HL (HL) Temperature requires one operable function. The RCS HL Temperature is also credited in Technical Requirements Manual (TRM) 3.3.D (Appendix R Alternate Safe Shutdown Instrumentation).
TS 3.3.4 Action Statement A.1 was entered for inoperable Wide Range Hot Leg Temperature Instruments TI-5139 (Loop 21) and TI-5141 (Loop 22). The RCS HL indication in the remote shutdown panel is limited to the two instruments referenced in the TS 3.3.4 Basis and there are no redundant instruments to perform the function remote from the control room. The condition was considered a SSFF under 10CFR50.72(b)(3)(v) and an 8- hour non-emergency notification was provided to the NRC (EN#46222) at 16:53 hours.
Past Similar Events
A review was performed of the past three years of Licensee Event Reports (LERs) for events that reported a loss of remote shutdown instruments for Indian Point Unit 2.
Two LERs were identified: LER-2009-003 and LER-2009-004. LER-2009-003 reported a SSFF for an inoperable 21 Pressurizer Backup Heater that is credited in TS 3.3.4. LER-2009 004 reported a SSFF for an inoperable 23 Charging Pump that is credited in TS 3.3.4.
These LERs were SSFFs as a result of failed components (breaker and internal pump valve) and not remote shutdown instruments.
Safety Significance
This event had no effect on the health and safety of the public.
There were no actual safety consequences for the event because there was no shutdown requiring the use of the remote shutdown panel. There was no significant potential safety consequences of this event because in accordance with NUREG-0800, Section 7.4, shutdown remote from the CR is not an event analyzed in the USFAR for accident analysis (Chapter 14). Specific scenarios are not specified on which the adequacy of shutdown capability remote from the CR is evaluated. A recognized type of event that could force the evacuation of the CR and the need to shut down remote from the CR is smoke from a fire. Fire damage limits as they impact safe shutdown do not require consideration of an additional random single failure in the capability to safely shut down. Therefore, application of single failure to remote shutdown is applicable only to other events that could cause the CR to become uninhabitable. These events would not result in consequential damage or unavailability of systems required for safe shutdown.