05000286/LER-2008-002
| Indian Point 3 | |
| Event date: | 2-19-2008 |
|---|---|
| Report date: | 4-18-2008 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 2862008002R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On February 19, 2008, while at 100% steady state reactor power, the Control Room {NA} received an alarm due to a trip of the 31 Pressurizer backup heater group {EHTR}.
Investigation determined that the 31 backup heater group was inoperable due to failure of a transformer {XFMR}. Technical Specification (TS) 3.3.4 (Remote Shutdown), Condition A was entered for loss of a single remote shutdown heater. The condition was recorded in the Indian Point Corrective Action Program (CAP) as CR-IP3-2008-00504.
This event was initially determined to be not reportable because the 32 and 33 backup heaters were available and operable as required by TS 3.4.9 (Pressurizer), the procedure for safe shutdown outside Control Room directed the use of these backup heaters when 31 backup heater was out of service, and these backup heaters were capable of local operation. For this reason an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> notification under 10 CFR 50.72(b)(3)(v)(A) was not made. This was not the proper decision because entering Condition A of TS 3.3.4 indicated that the operators believed the 32 and 33 backup heaters were not part of the train for remote shutdown and, therefore, 10 CFR 50.72(b)(3)(vi) would not allow them to be credited for performance of the safety function. The event should therefore have been reported under 10 CFR 50.72(b)(3)(v)(A).
Inspection of the transformer found visual damage on the 'B' phase coil. The outer winding of the 'B' phase coil was telescoped out. The telescoped coil is an indication that there was a large current surge on the secondary side of the transformer. The transformer was electrically tested and indicated a short circuit between the primary and secondary windings of the transformer. The apparent cause for the transformer failure was an insulation breakdown between the primary and secondary windings of the transformer. The insulation breakdown resulted in a short circuit that caused the transformer to fail. Onsite testing of the transformer could not determine the cause of the insulation breakdown and resulting short circuit. The transformer has been sent to the vendor for failure investigation. The failure investigation report will be used to determine the exact cause of the failure and the need for any follow up corrective actions. A replacement transformer was installed on March 12, 2008 restoring operability of the pressurizer heater function for the TS 3.3.4 LCO.
Based on an evaluation by engineering, no extent of condition actions were determined to be needed for this condition.
The Cause of Event The apparent cause for the transformer failure was an insulation breakdown between the primary and secondary windings of the transformer.
Corrective Actions
The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the cause(s) of this event.
- The failed transformer has been sent to the vendor for failure investigation. The failure investigation report will be used to determine the exact cause of the failure and results will be incorporated into the corrective action process.
- , A replacement transformer was installed for the 31 Pressurizer backup transformer heater function.
Event Analysis
The event is reportable under 10 CFR 50.73 (a)(2)(v)(A) which says "Any event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to: (A) Shut down the reactor and maintain it in a safe shutdown condition." The 31 Pressurizer backup heater group is credited in the FSAR for shutdown outside the control room for non-mechanistic events. Extensive discussions were held with the NRC residents and the NRC provided their position that the loss of the 31 Pressurizer backup heater group constituted a reportable event under both 5.0.72 and 50.73 since shutdown from outside the Control Room was a safety function included under these reporting requirements. Based on the feedback from the NRC it was agreed that the design function of shutdown from outside the Control Room had to be accomplished using only the 31 Pressurizer backup heaters since this was the current licensing basis. The following bases for initially not reporting this event were considered, but were found to be invalid based on the feedback received from the
NRC:
- The original FSAR credited only the 31 Pressurizer backup heaters for the remote shutdown function. A 1983 modification added the capability to locally operate all three backup heater banks without control power using their local push button. This would be done at the 480 V switchgear and would allow remote shutdown for Appendix R. The modification did not add this capability to the FSAR section that discussed non-mechanistic remote shutdown capability or initiate a surveillance test for the local push buttons. A procedure for remote shutdown was issued directing use of the local push buttons when the 31 Pressurizer backup heater bank could not be operated from the remote local station. When the, improved Technical Specifications were issued in 2003, the requirements for remote shutdown outside Control Room identified the FSAR Section discussing the 31 Pressurizer backup heater bank. Other backup heater banks were not explicitly identified and there were no Surveillance requirements for the local push buttons. However, a PM was performed in the last two years showing operability of the pushbuttons and a TS 3.4.9 Surveillance Requirement for the other Backup Heater Banks demonstrated the functionality of the heaters. These other heaters were credited to make the initial determination that this condition was not reportable. However, it was not appropriate to conclude the safety function is met because the FSAR and Technical Specifications do not specify use of the local pushbuttons for remote shutdown. Therefore, they can not be considered part of the same train so 10 CFR 50.72(b)(3)(vi) and 10 CFR 50.73 (a)(2)(vi) does not allow them to be credited for demonstrating performance of the safety function.
- TS 5.5.14 "Safety Function Determination Program (SFDP)" says "This program ensures loss of safety function is detected and appropriate actions taken.
The program specifies "A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed." This does allow a conclusion that there is no loss of safety function because the loss of safety function determination only applies to components credited in the accident analysis. The feedback from the NRC was that 50.72 and 50.73 reporting requirements apply to all safety functions, including remote shutdown, regardless of whether they are credited in the accident analysis.
- Regulatory Issue Summary 2001-14 provided guidance and noted that from "1984 until late 2000, the NRC's reporting guidelines in NUREG-1022 stated that if the plant's safety analysis considered RCIC as a system needed to remove residual heat (e.g., it is included in the Technical Specifications) then its failure is reportable under the criterion; otherwise, it is not reportable under this section of the rule...The NRC staff has recently reconsidered this position and concluded that reporting of RCIC system failure or inoperability is required by the relevant regulations only for plants whose final safety analysis report explicitly credits the RCIC system for mitigating the consequences of a rod ejection accident. This interpretation avoids the implication that RCIC system failures are reportable simply because the RCIC system is included in the plant's TSs." The feedback from the NRC was that the Regulatory Issue Summary was not applicable to the remote shutdown function requiring the 31 Pressurizer backup heater group as this was considered a different issue.
Past Similar Events
A review was performed of Licensee Event Reports (LERs) for the past three years for any events reporting loss of safety function. No LERs were identified that reported loss of safety function.
Safety Significance
This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients requiring shutdown outside the control room and safe shutdown outside the Control Room could be accomplished with the 32 and 33 Backup Heaters (required by Technical Specification 3.4.9) and the local pushbuttons or without the use of heaters.