05000247/LER-2012-009
| Indian Point 2 | |
| Event date: | 11-28-2012 |
|---|---|
| Report date: | 04-15-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 2472012009R01 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}
DESCRIPTION OF EVENT
On November 26, 2012, Operator review of a tag-out for Preventive Maintenance (PM) of the Steam Generator (SG) blowdown (BD) (SGBD) {WI} radiation monitor R-49 {IL} determined the tagout would place all the SGBD isolation valves (ISVs) in Rad Bypass.
Operators could not identify any procedure allowing this action and determined that a similar condition was previously reported in LER-2012-004 as an unanalyzed condition and safety system functional failure. LER-2012-004 reported that use of the Rad Bypass switch position for SGBD ISVs would defeat the automatic isolation of the SGBD ISVs for degraded heat sink events. LER-2012-004 reported that on March 27, 2012, during management review of current condition reports (CR), a CR recorded a condition regarding the use of the Rad Bypass switch. Management review identified a past event at unit 3 which resulted in a reportable event. A CR was initiated (CR-IP2-2012-02408) for a review and evaluation on the use of the Rad Bypass feature associated with the control switches for the SGBD isolation valves {ISV} {HIS} position for SGBD isolation valves above mode 3 and when applicable in 4 would defeat the automatic isolation of the blowdown isolation valves for degraded heat sink The use of the Rad Bypass switch events [Loss of Normal Feedwater (UFSAR Section 14.1.9), Loss of All AC Power to Station Auxiliaries (UFSAR Section 14.1.12)] is open which allows the ISVs to Auto close for heat sink events in addition to The normal SGBD isolation valve position containment Phase A isolation. The Containment Phase A isolation function is unaffected. These analyzed events assume SGBD isolation occurs and continuous SGBD during these events has not been analyzed. SG inventory may not be maintained because one Auxiliary Feedwater (AFW) {BA} pump {P} would not provide adequate flow with the blowdown isolation valves open.
A previous review of past operation for usage of Rad Bypass identified that on January 19, 2011, test 2-PC-2Y23-49 (Liquid Radiation Monitor Calibration) was initiated and on January 22, 2011, at 17:00 hours, the SGBD isolation valve switches were positioned in Rad Bypass. Test 2-PC-2Y23-49 was exited on January 27, 2011. During this time on January 20, 2011, the 21 Auxiliary Feedwater Pump (AFWP) was removed from service for testing. For degraded heat sink events, failure to close the SGBD isolation valves would result in inadequate maintenance of SG inventory because one Auxiliary Feedwater pump would not provide adequate flow with the blowdown isolation valves open. Although the turbine driven AFW pump was available, this pump requires operator action to provide flow to the SGs. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as Condition Report CR-IP2-2012-02408 (as reported in LER-2012-004) Subsequently, on November 26, 2012, operators reviewing a draft tagout for a one year PM on radiation monitor R-49 (SGBD) questioned the tagout boundaries because the proposed tagout would place all the SGBD isolation valves in Rad Bypass. Operators could not identify any procedure that would allow placing the SGBD isolation valves in Rad Bypass. The draft tagout was developed from an archived tagout for the one year PM.
the improper use of the Rad Bypass switch. The condition was recorded in the IPEC CAP as CR-IP2-2012-06920. As a result of identifying this condition, operations revised (locked-out) the tagouts that would place the SGBD valves in Rad Bypass. The archived tagout used as a basis for a new tagout was 2C20-1/RM-133-R-49 1YR PM. A review determined that this tagout was hung on May 3, 2011 at 03:10 hours and removed on May 6, 2011 at 16:46 hours.
Management responded to the operations question noting a previous LER reporting The procedure is an Instrumentation and Control (I&C) procedure with switch positioning performed by operations. The procedure has a Caution that during testing of monitor R- 49, placing a SG blowdown valve control switch in Rad Bypass inhibits its automatic closure for AMSAC, Main Boiler Feed Pump trip, and AFWP start (AMSAC is degraded but not inoperable) Operators performing the test knew the cautions but performed the switch manipulation in accordance with the procedure as reported in LER-2012-004.
An extent of condition (EOC) review was conducted to identify other procedures (I&C and Operations) that reference use of the Rad Bypass switch at unacceptable times as reported in LER-2012-004. The following procedures were identified: 1) 2-SOP-7.1 (SGBD Operations), 2) 2-SOP-1.11 (SG Filling, Wet Layup, Recirculation and Sparging), 3) 2- SOP-1.10 (SG Draining and dry Layup), 4) 2-PT-R141 (Phase A Testing), 5) 2-PC-2Y23-49 (Liquid Radiation Monitor Calibration), 6) 2-PC-Q76 (R-49 Channel Test), 7) 2-PT-M97 (R-49 source check), 8) 2-PT-Q70 (R-49 Flow Meters) The review determined only one procedure would provide an impact (2-PC-2Y23-49) and this procedure was revised.
a result of CR-IP2-2012-06952, an expanded extent of condition review determined that there were Maintenance activities requiring tagouts that used the Rad Bypass switches.
In addition to the initial set of 10 tagouts discussed earlier, there were four additional Maintenance tagouts that put the SGBD isolation valves in Rad Bypass but these tagouts were greater than three years old. These tagouts were also locked out to prevent use as an archive tagout. No other unit 2 impacts were identified and unit 3 had this condition identified in 2001 and the corrections for that event were maintained (LER-2001-001) As The Cause of Event The apparent cause was the reviews associated with the condition recorded in CR-IP2- 2012-02408 were too narrowly focused. Reviewers failed to consider processes other than procedures that could place the SGBD ISV in Rad Bypass. The apparent cause for inappropriate use of the Rad Bypass Switch reported in LER-2012-004 was due to inadequate review during historical procedure review and inadequate implementation of the Operating Event (OE) for a Rad Bypass event at Unit 3 (OE 12628) The test procedure revision in 2002 deleted information from an OE that restricted when the blowdown radiation monitor could be tested. Procedure revision 3 had an inadequate review of the basis of revision 2 which incorporated the OE restricting the use of Rad Bypass when testing Radiation Monitor R-49 (SGBD) to when the reactor coolant system (RCS) is less than 350 degrees. Operators were aware of the purpose of the switch (to override closure signals), but were not aware of the assumptions for the applicable analyzed events in the UFSAR. The UFSAR for the analyzed events did not specifically state that SGBD isolation is assumed starting from event initiation.
Corrective Actions
The following corrective actions have been performed under the Corrective Action Program (CAP)
- Procedure 2-PC-2Y23-49 was revised to delete steps to place SG Blowdown Isolation Valves in Rad Bypass while performing Radiation Monitor R-49 calibration and to install a test jumper to disable the blowdown function from Radiation Monitor R-49 (as reported in LER-2012-004)
- Applicable Maintenance tagouts were locked-out to prevent their use as archive tagouts.
UFSAR Section 14.1.9 was revised to state that SGBD isolation is assumed starting from event initiation (as reported in LER-2012-004) UFSAR Section 14.1.12 was not revised as it references UFSAR Section 14.1.9 for decay heat removal by the AFW System.
I
- The completed ACE will be shared with all Department Performance Improvement Coordinators (DPIC's) at a monthly meeting to make them aware of the need for thorough extent of condition reviews and thorough CR closure.
All Corrective Action Review Board (CARE), On-Site Safety Review (OSRC) and Operations management members will review the completed ACE to increase awareness regarding EOC reviews.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(ii)(B) and 10CFR50.73(a)(2)(v)(B) The licensee shall report any condition that resulted in: (B) The nuclear power plant being in an unanalyzed condition that significantly degraded plant safety, and any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to (B) Remove residual heat. This event meets the reporting criteria because placement of the switch for the SG Blowdown isolation valves in Rad Bypass on January 19-27, 2011, defeated their Auto close function for degraded heat sink events (Loss of Normal Feedwater, Loss of All AC Power to Station Auxiliaries) while the 21 AFW pump was out of service. Failure to close the SG blowdown isolation valves would result in inadequate maintenance of SG inventory because one motor driven Auxiliary Feedwater pump would not provide adequate flow with the blowdown isolation valves open. Each motor driven AFW pump feeds two SGs. The turbine driven AFW pump feeds all four SGs. Subsequently, on November 28, 2012, a review of the archived tagout condition recorded in CR-IP2-2012-06920 determined the tagout required the Rad Bypass switch to be in Rad Bypass and the 21 AFW pump was out of service on May 3, 2011. Further review identified another tagout on December 8, 2009, that required the Rad Bypass switch to be in bypass while the 23 EDG was out of service. The 23 EDG provides the emergency power for the 23 AFW pump which would be required for the analyzed events (LOOP, Loss of Normal Feedwater), which assume SGBD isolation. These analyzed events assume SGBD isolation occurs and continuous SGBD during these events has not been analyzed. The condition was a safety system functional failure (SSFF) since during the maintenance activity one motor driven AFWP was out of service or its emergency power supply was out of service resulting in inadequate maintenance of SG inventory. In accordance with reporting guidance in NUREG-1022, for a SSFF per 10CFR50.73(a)(2)(v,)an additional random single failure need not be assumed during the condition. As a result of identifying additional conditions (tagout) that placed the Rad Bypass switches in Rad Bypass a review of LER-2012-004 determined the extent of condition missed the opportunity to identify the past tagout issues. This condition was recorded in CR-IP2-2013-00191. As the tagout conditions did not occur during a single activity over a reasonably short time a new LER was initiated.
Past Similar Events
A review was performed of the past three years of Licensee Event Reports (LERs) for events reporting control switches that could defeat or bypass automatic design features. One Unit 2 LER was identified (LER-2012-004) use of the Rad Bypass switch position for SGBD ISVs would defeat the automatic isolation of the SGBD ISVs for degraded heat sink events. During the condition on January 19-27, 2011, the 21 AFW pump was out of service resulting in an unanalyzed condition and a SSFF.
LER-2012-004 reported that
Safety Significance
This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no applicable accidents or transients (LONF or LOOP) during the time testing was performed by 2-PC-2Y23-49 (LER-2012-004) and during the time that the tagouts in question were in place. During the time testing was being performed and during tagouts to support Maintenance work which required the SG blowdown isolation valve switches to be positioned in Rad Bypass, the turbine driven AFW Pump (AFWP) was available and capable of providing adequate feedwater flow to maintain SG inventory. Operators have CR instrumentation available for monitoring SG level and alarms to alert them to low levels. Alarm response procedures are provided for low SG level which would be entered and appropriate actions taken. Operators would know the SGBD isolation valves were in Rad Bypass and would take mitigating action if a heat sink event occurred. For the LONF or LOOP events, procedure 2-E-0 (Reactor Trip or Safety Injection) would be entered. At step 4 (check Safety Injection (SI) Status), for SI not required, the procedure requires 1) verification of AFWP(s) running as necessary to establish total feed flow greater than 760 gpm, 2) maintain total feed flow greater than 760 gpm, 3) Go to 2-ES-0.1 step 1.
The basis for 2-E-0 states for SI not required, AFWPS are started to satisfy SPU LONF/LOAC Analysis requiring 760 gpm AFW flow within 10 minutes for heat removal if only one motor driven pump auto starts. Feedwater flow to the SGS will not be affected by the condition and heat sink cooling will be provided by use of the SG atmospheric dump valves (ADVs), or condenser steam dump, and in this case blowdown. SG inventory will be impacted but plant procedures will ensure SG narrow range level is reestablished in all SGS to maintain symmetric cooling of the RCS. Additionally, SG blowdown is normally throttled by valve MS-71 to approximately 20 gpm even with the SG blowdown isolation valves open. During the May 3, 2011 event per 2C20-1/RM-133-R-49 1YR PM, SG blowdown was approximately 25 gpm, and for the December 8, 2009 event, tagout SW-087-B-SWN-945 PM, SG blowdown was also approximately 25 gpm per SG.