05000286/LER-2001-001
| Docket Number | |
| Event date: | 05-10-1999 |
|---|---|
| Report date: | 06-01-2001 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(vi) 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2862001001R00 - NRC Website | |
FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3) Note: The Energy Industry identification system codes are identified within brackets {)
DESCRIPTION OF EVENT
The event occurred on April 3, 2001, at approximately 2133 hours0.0247 days <br />0.593 hours <br />0.00353 weeks <br />8.116065e-4 months <br />, with steady state reactor power at approximately 100 percent. During the performance of surveillance 3PC-R49A (Steam Generator Radiation Monitor Calibration), the eight Steam Generator {SG} (SG) blow-down isolation valve {ISV} control switches {HIS} were placed in the "Rad Bypass" position. The Rad Bypass switch position rendered them incapable of receiving the auto close signal from low-low Steam Generator level, main boiler feed pump {P} (MBFP) auto-trip, 480 Volt bus {BU}, undervoltage (Bus 2A or 3A and Bus 5A or 6A), area high temperature and high radiation. The significance of the area temperature monitor {TM} bypass was recognized and a 7 day allowed outage time was imposed by plant administrative controls. During a review the following day, System Engineering identified that the signals isolated by Rad Bypass that were the primary and anticipatory signals to isolate SG blow-down following a loss of normal feedwater (LONF) transient and for a loss of off-site power (LOOP) transient. SG blow-down must be isolated because the Auxiliary Feedwater Pumps (AFW) are not sized to compensate for the loss of SG inventory due to blow-down flow during a LONF or LOOP.
Bypass caused the eight blow-down isolation valves to become inoperable. The eight isolation valves are required to isolate to allow adequate removal of decay heat through the SG's. The isolation signals from the phase A containment isolation signal and from AMSAC were not bypassed.
Surveillance procedure 3PC-R49A for calibration of the SG blow-down radiation monitor directed the person performing the test to have operations place the blow-down and blow-down sample isolation valve switches in the Rad Bypass position, if plant conditions warranted. This has been performed twice during power operation. The operators who reviewed surveillance test 3PC-R49A understood that blow-down isolation signals would be blocked when using the Rad Bypass switch position and questioned whether this was acceptable. The operators, with the assistance of Licensing and Instrumentation and Control (I&C), reviewed the Technical Specifications (TS), Final Safety Analysis Report (FSAR), and other documents to determine whether there was any reason the Rad Bypass position could not be used. The TS, TS Bases and FSAR do not describe the blow-down isolation function with regard to the postulated events LONF and LOOP. The Accident Analysis Design Basis Document (AADBD) does not discuss this function either. Lack of understanding of the assumptions credited in the LONF and LOOP transient analyses led to the use of the Rad Bypass switch position on April 3, 2001. The lack of understanding of assumptions was caused by a failure to include the assumption of SG blow-down isolation in the design and licensing basis documents.
The failure to include assumptions about blow-down was caused by inattention to detail by the engineers responsible for developing and maintaining these documents.
It is not clear, however, when the engineers should have recognized this design and the need to incorporate it into the design documents and licensing basis. This is still being evaluated under the corrective action program. Contributing to the lack of knowledge was the failure by Westinghouse to communicate the assumption of SG blow-down isolation valve closure in their FSAR descriptions of the LONF and LOOP analyses as well as in the AADBD.
FACILITY NAME (1) PAGE (3) DOCKET (2) LER NUMBER (6) An extent of condition review was conducted to identify other procedures using Rad Bypass at unacceptable times. Eight procedures, including 3PC-R49A, were identified and they are being revised. These are:
1. Two of these tests (3PT-M13B and 13B.1) are monthly tests that allowed use of the Rad Bypass during functional testing of Reactor Protection Logic. Only one of the two tests would be used and then only every other month (only the train B test used the Rad Bypass). The Rad Bypass step has been in this test since May of 1989.
2. Two other tests (3PT-V07A and 07B) test the MBFP overspeed. The use of the Rad Bypass switches were added in January 1998 and the test was performed only once using 3PT-V07A, on October 21, 1999.
3. Two operations procedures (SOP-SG-001 and ONOP-ES-001) utilize the Rad Bypass switches when lining up SG blow-down to Unit 1 in response to a tube leak and when recovering from a failed area high temperature instrument that has isolated blow-down. The use of the Rad Bypass switches was added to the procedures in March 1980 and May 1989, respectively. One operations procedure (SOP-FW-001) utilizes the Rad Bypass switches when testing the MBFP trip function. The testing is done while placing the pump inservice following any outage of more than 7 days.
An extent of condition review was performed considering similar control switches.
The review included a walk-down of the Control Room (CR) simulator supervisory and flight panels followed by a review of relevant schematic drawings. The review found no control switches that could defeat or bypass automatic design features whose effect on components was not recognized previously in procedural guidance. For example, the trip pullout position for switches was known to render safety components inoperable. Other examples are feedwater isolation defeat switches, SI manual defeat switches, and SI block. The SG blow-down sample valves also have a Rad Bypass with different signals bypassed. However, the sample flow has been accounted for in determining AFW flow.
CAUSE OF THE EVENT
The cause of the inappropriate use of the Rad Bypass switches was the lack of guidance on the design requirements of the SG blow-down isolation available to plant personnel. This lack of guidance was caused by inattention to detail by the engineers responsible for developing and maintaining the FSAR and the AADBD.
Contributing to the lack of guidance was the failure by Westinghouse to communicate the assumption of the SG blow-down isolation valve closure in their FSAR LONF and LOOP analyses as well as in the AADBD.
CORRECTIVE ACTION
The following corrective actions have been or will be performed under the corrective action program to address this event:
- Immediate corrective action was taken to direct the operators not to use the Rad Bypass switch position until required corrective actions were taken.
- The FSAR and AADBD will be updated to describe blow-down isolation requirements.
FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)
- The five I&C surveillance procedures allowing Rad Bypass are being revised prior to the next usage to preclude Rad Bypass of all SG blow-down valves during periods of time when this is not within the analyzed design basis. The three Operations procedures have been revised. Future use of Rad Bypass of all SG blow-down valves for these procedures will require a design change (modification or analysis) to assure SG inventory.
- The corrective action program will assess when the effects of the Rad Bypass Switch position should have been identified and entered into the FSAR.
ANALYSIS OF EVENT
The event is reportable under 10 CFR 50.73(a)(2)(v), any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to remove decay heat.
This event meets the reporting criteria. Placing the switch in Rad Bypass for the eight SG blowdown valves would reduce SG inventory during a LONF or LOOP event such that a single motor driven AFW pump would not provide sufficient makeup water for decay heat removal. 10 CFR 50.73(a)(2)(vi) does not require reporting under 10 CFR 50.73(a)(2)(v) if redundant equipment was operable and available. The 32 AFW pump was not credited as redundant equipment because specific guidance in the emergency operating procedures (EOPs) for operation of the 32 AFW pump would not have ensured that SG inventory was maintained (the EOP setpoint for AFW flow would be met so operators would not be directed to use the pump). A review of plant documents for the last three years, the period of reportability per 10 CFR 50.73(a)(1), was conducted for the procedures allowing the Rad Bypass. The review revealed that both motor driven AFW pumps were operable when 3PT-13B, 3PT-13B.1, and 3PT-V07A were performed. These events are not reportable since NUREG 1022 guidance for reporting says it is not necessary to assume a single failure and two motor operated AFW pumps are adequate to maintain SG inventory following LONF or LOOP without SG blowdown isolation. Procedure SOP-FW-001 was performed while putting the main feed pumps inservice during startup from the 1999 refueling outage. Both motor driven AFW pumps were operating at this time (about 4 percent power) and both main feed pumps were started (one in standby) at this power level. There was no other instance during startup in the last three years where one main feed pump was out of service for seven days during shutdown or while at higher power levels (the threshold for the test).
Therefore, there is no reportable event for this procedure. The review for 3PC-R49A showed the test was performed at power on May 10, 1999 and April 3, 2001. The April 3 event was not reportable because the two motor driven feedwater pumps were available. The May 10 event is reportable since the 31 motor driven AFW pump was out of service for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 12 minutes during the performance of the calibration.
A review determined that no Licensee Events over the past two years has identified a loss of safety function due to surveillance testing.
SAFETY SIGNIFICANCE
This event had minimal effect on public health and safety.
No actual LONF or LOOP occurred while the switches for the eight SG blow-down valves were in the Rad Bypass position.
FACILITY NAME (1) PAGE (3) DOCKET (2) LER NUMBER (6) The significance of a LONF or a LOOP occurring while the eight blow-down isolation valves were in Rad Bypass and a motor driven AFW pump was out of service was evaluated. An evaluation estimated conditional core damage probability (CCDP). The evaluation assumed a 2 out of 2 motor driven AFW pump success criterion and AFW 31 pump out of service. An additional factor of 0.1 (the human performance error screening value) was included that operators would not check position and isolate the blow-down isolation valves (required by the ONOP for loss of main feed pumps) and initiate the steam driven AFW pump. These factors resulted in a conditional core damage frequency of 6.06E-4 per year using the IP3 Individual Plant Examination, Rev 0. The CCDP of 1.52E-7 was determined considering the Rad Bypass switch position was used for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 12 minutes on May 10, 1999 while a single motor driven AFW pump was available.
Indian Point 3 05000286