05000247/LER-2010-008

LER-2010-008, Safety System Functional Failure Due to Inoperable Refueling Water Storage Tank Low- Low Level Alarms

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
2472010008R01 - NRC Website

Note:� The Energy Industry Identification System Codes are identified within the brackets O.

DESCRIPTION OF EVENT

On September 13, 2010, while at a steady 7.1% reactor power, alarm checks were being performed on the main control room annunciator panels by pushing the test button and verifying the alarm can illuminates and the horn sounds. When operations pushed the test button, panels SA-SC (IB) did not illuminate. At 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> Operations declared the Refueling Water Storage Tank (RWST)(BP) (TR) inoperable per Technical Specification (TS) 3.5.4 Condition C and entered Procedure AOP-ANNUN-1 "Failure of Flight or Supervisory Panel Annunciators" to diagnose the problem. A ten amp fuse (FU-CCR-SD-4A)(FU) had blown on the negative feed in panel SD (EJ). The fuse was replaced and the alarm test was performed satisfactorily. At 2013 hours0.0233 days <br />0.559 hours <br />0.00333 weeks <br />7.659465e-4 months <br /> the Panels SA-SC were restored to operation and the RWST was declared operable. CR-IP2-2010-5713 was generated for this event.

TS 3.5.4 requires the RWST to be operable in Modes 1, 2, 3, and 4. Condition B is entered with "One of two required channels of the RWST low-low level alarm inoperable" even though the LCO does not explicitly call out that the low-low level alarms (LA). The loss of the two low-low level alarms is considered a safety system functional failure (SSFF) because the TS 3.5.4 Condition B indicates that two channels are required which is consistent with the custom TS that required two alarm channels to be operable.

When the two channels of the RWST low-low level alarm were declared inoperable, the RWST was declared inoperable in accordance with TS 3.5.4 Condition C, RWST inoperable for reasons other than Condition A or B. This was not considered a SSFF at the time due to the continued availability of the RWST tank and the redundant RWST level indicators required by TS 3.3.3. No eight hour emergency notification was made for a SSFF. Operations concluded there was no SSFF due to the continued availability of the RWST and the availability of the redundant level indicators to initiate recirculation. Condition Report CR-IP2-2010-5913 evaluates this event.

Past occurrences were evaluated. In 1996 and 1997 alarm cans in panels SA-SC were found to have shorts and replaced. The design of the annunciator alarm cans was upgraded from a flexible design to a hardwire design to address a relay contact issue (i.e., relays in the alarm cans aged due to temperature and this caused arcing and grounding that blew the fuses). In 2005 a 10 amp fuse was found blown but the event was not called reportable and no apparent cause was performed. The 1997 event and the current event occurred when coming out of a mini outage where most of the alarms are lit and temperatures are higher. The corrective actions after the 1997 event are believed to have corrected temperature problems. The 24 battery charger (BC), which feeds the SA-SC annunciator panels, has a history of ground alarms which testing has been unsuccessful in fully identifying and eliminating. Although the 24 BC shows an extensive history of ground alarms that could potentially blow the fuse, engineering determined grounds was not the cause because the local ground alarm for the 24 BC did not annunciate.

Cause of Event

Over current condition is the direct cause of the fuse blowing. The apparent cause of the fuse failure was fuse fatigue. The contributing cause was the 10 amp fuse for the annunciator circuit was marginally sized for its design load. After several years of actuation and approaching the instantaneous load, the fuse could fail due to fatigue.

Corrective Actions

The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:

• An evaluation was performed of the fuse size for the Control Room (CR) Supervisory Panels. The evaluation determined the existing 10 amp fuses were marginally sized and should be replaced with 15 amp fuses.

• The annunciator panel fuses in the Control Room Supervisory Panels SAF, SAF-1, SBF-1, SBF-2 and SCF were replaced with 15 amp fuses.

• The unit 3 annunciator circuit design will be evaluated as an extent of condition action.

Event Analysis

The event is reportable under 10CFR50.73(a)(2)(v)(D), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: "(D) mitigate the consequences of an accident." On September 13, 2010, at 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br />, the RWST was declared inoperable when power was lost to the panels SA-SC. The power loss resulted in the loss of two RWST low-low level alarms. TS 3.5.4 Condition B supports that two RWST low-low level alarms are required. The alarms are used to alert the operator to initiate actions to transfer from injection phase to recirculation phase following a LOCA. The RWST Level indicators and sump indicators covered under TS 3.3.3 can be used to confirm RWST level prior to the manual switchover to the cold leg recirculation phase. The condition was originally not considered a SSFF due to an understanding that the RWST level indicators could be used to perform the function and, therefore, no 8­ hour non-emergency notification was provided to the NRC under 10CFR50.72(b)(3)(v).

Condition report CR-IP2-2010-5913 evaluates the missed call.

Past Similar Events

A review was performed of the past three years of Licensee Event Reports (LERs) for events that reported a SSFF due to the loss of a power supply. No such events were identified and condition reports on such events were not found.

Safety Significance

This event had no effect on the health and-safety of the public.

There were no actual safety consequences for the event because there was no accident requiring use of the RWST. There were no significant potential safety consequences of this event because the redundant level indicators required by TS 3.3.3 were available and operations is trained to rely on these indicators for switchover to recirculation.