05000266/LER-2001-002
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2662001002R00 - NRC Website | |
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Point Beach Nuclear Plant Unit 1 05000266
Event Description:
On January 12, 2001, a condition report (CR 01-0108) was originated which questioned the existing practice of defeating the steam generator [SG] blowdown [WI] isolation interlock when an electric driven auxiliary feedwater [BA] pump [P] is taken out of service. Specifically, the concern was that preventing blowdown isolation may impact conservation of steam generator inventory (the heat sink) at a time when a source for adding inventory to the steam generators is not available. This condition was referred to system engineering to evaluate the concern.
Steam generator (SG) blowdown is normally interlocked with the auxiliary feed (AF) water system such that the blowdown will be automatically isolated under the following conditions:
1. Open or intermediate position of either steam supply valve [SCV] to the turbine [TRB] driven AF pumps.
2. Start of either motor [MO] driven AF pump.
3. Racking out the breaker [BKR] for either motor driven pump.
The motor driven pumps, which are shared between the two Point Beach Nuclear Plant (PBNP) units, are interlocked with SG blowdown for both units. In order to prevent isolating, and thereby interrupting, SG blowdown flow while the AF pumps are taken out of service for maintenance or surveillance, the plant was modified in 1982 to install two SG blowdown interlock defeat key switches [HS]. Prior to that modification, during AF system pump testing, the hand switches for the SG blowdown isolation valves [ISV] were taped in the open position to preclude interruption of SG blowdown during the test.
In addition to the interlock with the AF pumps, SG blowdown is also automatically isolated on a containment isolation signal and in the event of a high radiation signal as sensed on the blowdown discharge. The interlock defeat key switches did not affect these blowdown isolation signals.
On April 17, 2001, the engineering evaluation of this condition was completed. This evaluation (CR 01-1321) documented an analysis which determined that defeating the SG blowdown isolation interlock with AF would prevent the AF system from providing the heat removal equivalent feedwater flow (200 gpm) to each unit necessary for post accident decay heat removal. Although the amount of feedwater provided to the SGs by the AF pumps would be the same, some of that coolant would be diverted through the blowdown connections. This feedwater would be ineffective in the removal of heat energy from the SG "U" tubes since the blowdown connections are just above the tube sheet. In addition the removal of the heat of vaporization as the feedwater flashes to steam in the SG would be lost. Discussions with the NSSS vendor also verified that the Loss of Normal Feedwater (LONF)/ Loss of External AC (LOAC) accident models assumes SG blowdown isolation along with the 200 gpm of AF per unit.
At the time this condition was verified, PBNP Unit 1 was in a refueling shutdown. Unit 2 was operating at full power.
Neither unit was operating with the blowdown isolation interlock defeated. This condition was evaluated for reportability under 10 CFR 50.72(b)(3)(v) and 50.73(a)(2)(v). Since the event or condition, that is blowdown interlock defeat, at the time of discovery was not in effect, this condition was determined to be reportable under 50.73(a)(2)(v) as, "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:
...(B) Remove Residual Heat; ..-." As clarified in Paragraph 50.73(a)(2)(vi), events covered under this reporting criteria may include discovery of design or procedural inadequacies. Availability and use of the blowdown interlock defeat key switch is considered to be applicable under that paragraph.
Component and System Description:
The auxiliary feedwater system at PBNP is a shared system. Each unit has its own steam turbine driven AF pump (1P- 29 and 2P-29 for Unit 1 and 2 respectively) which can supply up to 400 gpm but is normally throttled at 260 gpm. The motor driven AF pumps are P-38A and P-38B. Each pump can supply up to 200 gpm. They are normally aligned to both units, with P-38A providing feedwater to each unit's "A" SGs and P-38B to each unit's "B" SGs.
Point Beach Nuclear Plant Unit 1 05000266 Each steam generator is provided with bottom blowdown connections for shell side chemical and solids concentration control. The piping from the two connections join to form a 2" blowdown line which is routed from each steam generator through individual containment penetrations and air-operated isolation valves, heat exchangers, and manual flow control valves to the steam generator blowdown tank. The blowdown rate, to maintain the shell side chemistry conditions as required, is determined based on the results of analyses of steam and water samples taken from the steam generators.
Evaluation:
Two situations were considered for this evaluation. Situation One assumes 1P-29 out of service and in a LCO with only the Unit 1 SG blowdown isolation defeated. The second situation assumes P-38A out of service and in a LCO with the Unit 1 and Unit 2 SG blowdown isolation defeated. Since under both situations one AF pump is already in an LCO, an additional single equipment failure was not applied to this evaluation.
As discussed in the FSAR, a Loss of External Electrical Load or the Loss of External AC Power to the Station Auxiliaries can affect both units simultaneously. Therefore, this evaluation assumed the initiating accident or event would affect both units. For dual unit events, the flow from each motor driven pump is assumed to be equally divided between the units, 100 gpm to each unit from each motor driven AF pump. Although SG blowdown does remove some decay heat during an accident, for the purpose of this evaluation the heat removed by blowdown is assumed to be negligible and AF is still required to provide 200 gpm to each unit to meet the decay heat removal criteria.
Situation 1:
1P-29 is inoperable and the blowdown isolation interlock is defeated for Unit 1 only. (An example would be defeating the Unit 1 blowdown isolation for the performance of a surveillance test.) AF Flow Available U-1 � U-2 P-38A 100 gpm � P-38A 100 gpm P-38B 100 gpm � P-38B 100 gpm 1P-29 0 gpm � 2P-29 260 gpm 200 gpm � 460 gpm Since 200 gpm is required for each unit to remove decay heat for accident scenarios, Unit 1 does not have the sufficient AF flow to compensate for any SG inventory losses due to SG blowdown. Unit 2 SG blowdown will isolate since the interlock was not required to be defeated for either motor driven AF pump.
Situation 2:
P-38A is inoperable and the blowdown isolation interlock is defeated for U-1 and U-2. (An example would be racking out the breaker for maintenance on P-38A and defeating the U-1 and U-2 blowdown isolation.) FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Point Beach Nuclear Plant Unit 1 05000266 AF Flow Available U-1 U-2 7) scenarios. Therefore, both units can the maximum blowdown rate per generator is normally adjusted to 40 gpm per SG greater than 80 gpm per SG. Under those remove the decay heat and still was that, based on the existing blowdown isolation interlock defeated was 1982, for PBNP modification requests M- 1CO3 and 2CO3 adjacent to the start interlock with blowdown isolation to pump or opening the steam supply to the need for the prior practice of taping conducting surveillance tests of the AF testing. These switches were recognized start interlocks and did not override the isolation or high radiation signals. A of the interlock defeat function. While this determined to be acceptable at that time, for. Accordingly, we have discontinued other circuit modifications that achieve the on both units were initially caution tagged to tags to indicate that a dedicated and the unit's temperature is greater no longer necessary and have been installed for the motor driven AF pumps initiation signals: low low SG level, Safety blowdown isolation. The opening of the isolation. A SG blowdown isolation pump without isolating that unit's blowdown.
P-38A 0 gpm P-38A 0 gpm P-38B 100 gpm P-38B 100 gpm 1P-29 260 opm 2P-29 260 opm 360 gpm 360 gpm Again, 200 gpm is required for each unit to remove decay heat for these accident have up to 160 gpm of blowdown flow or 80 gpm per generator. However, is 100 gpm at 500 2 F (equivalent to 40 klbm/hr). Although PBNP SG blowdown or less, except during a unit startup; it is possible that blowdown could be conditions it is possible that the AF flow available would not be adequate to compensate for the blowdown loss. The conclusion of the engineering evaluation design of the blowdown interlock defeat circuit, future operation with the SG not recommended.
Cause:
The following information was found in a safety evaluation dated October 30, 730 and M-731. This modification installed the key switches on control panels blowdown control valve switches. These switches bypassed the AF pump prevent automatic closure of the valves when starting either motor driven AF either units turbine driven AF pump. These switches were installed to preclude the SG blowdown isolation valve control switches in the open position when pumps. This was done so that SG blowdown would not be interrupted during as an improvement to safety because the key switches only defeated the pump other automatic closure signals to the blowdown isolation valves from containment key switch was selected to ensure strict administrative control over the use practice of reliance upon an administrative control to defeat this interlock was this practice does not reflect the conservative decision making we now strive this practice and, as discussed in the Corrective Actions, will be investigating same result.
Corrective Actions:
As a result of this event, the following corrective actions have been completed:
1. Upon the discovery of this condition, the interlock defeat key switches prohibit their use. This tagging was later changed to temporary information operator is required anytime the SG blowdown isolation interlock is defeated than 350 2 F. Following the modification discussed below, these tags were removed.
2. A design change and modification (MR 01-052) has been approved and which will initiate SG blowdown isolation on the following automatic AF Injection, or AMSAC. Starting of a motor driven AF pump will not initiate steam supply valve to the turbine driven AF pump will still initiate SG blowdown defeat switch will still be available to permit testing of the turbine driven FACILITY NAME (1) PAGE (3) LER NUMBER (6) DOCKET NUMBER (2) Point Beach Nuclear Plant Unit 1 05000266 Safety Assessment:
Although the use of the SG blowdown isolation interlock defeat has been now recognized as a condition that has the potential to result in a loss of the safety function of decay heat removal, the specific conditions under which this loss of safety function would occur and the availability of operator initiated corrective action results in a low safety significance for this condition. A key controlled switch was used to further restrict inadvertent use of this feature. The evaluation and analysis discussed in this LER took no credit for operator actions subsequent to the event. However, if the auxiliary feedwater flow following the loss of AC power or normal feedwater was inadequate because the defeat switch was in use and blowdown was not immediately isolated, we consider it very likely that the operators would have recognized the gradual loss of steam generator inventory and would have taken action to increase SG level in the affected units by increasing flow from the steam driven AF pump, if available, or by repositioning the blowdown interlock defeat switches to restore the automatic blowdown isolation function.
A probabilistic risk assessment (PRA) study was completed to estimate the change in core damage frequency (CDF) as a result of failing to isolate blowdown from a steam generator following a plant trip initiator that does not also initiate an automatic containment isolation. No operator action for blowdown isolation was credited in this assessment. It is assumed that the pressurizer would go solid following a loss of normal feedwater if insufficient auxiliary feedwater flow is delivered to a SG. This condition could lead to a stuck open pressurizer safety valve which has consequences roughly equivalent to a medium break size loss of coolant accident. The result of the PRA study is an estimated increase in instantaneous core damage frequency (CDF) of 2.06E-05/yr when the defeat switch is in use. To reach the "low to moderate safety significance" threshold core damage probability (CDP) the blowdown isolation defeat switch would need to be in use for a total of 17.7 days or 425 hours0.00492 days <br />0.118 hours <br />7.027116e-4 weeks <br />1.617125e-4 months <br />. This is also the length of time each year that the switch would need to be in use to cause the average CDF to increase by 1.0E-06/yr. It is estimated that the SG blowdown isolation interlock defeat switch had typically been in use for any one unit for less than half that time. Accordingly, we believe that the impact on the health and safety of the public and plant staff as a result of this event was of very low significance.
Although the safety impact of this potential event was minimal, this condition met the reporting criteria of 10 CFR 50.73(a)(2)(v) and therefore will be recorded under the NRC Performance indicators for both units as a Safety System Functional Failure.
Similar Occurrences:
A review of recent LERs (past three years) identified no similar events involving the potential loss of safety function for the auxiliary feedwater or SG blowdown systems.