05000289/LER-2012-001

LER-2012-001, Single Condition Making Independent Trains Inoperable

Docket Number
Event date:	05-09-2012
Report date:	07-06-2012
Reporting criterion:	10 CFR 50.73(a)(2)(vii)(B), Common Cause Inoperability 10 CFR 50.73(a)(2)(vii)(A), Common Cause Inoperability
2892012001R00 - NRC Website

There were no structures, systems, or components out of service that contributed to this event.

Event:

In response to the Nuclear Regulatory Commission's request to see Three Mile Island Nuclear Power Station's (TMI-1) original response to Oconee 0E30225, TMI-1 discovered that the original review would need to be revised and generated issue report IR# 1364596. TMI-1 provided the original response to the NRC on May 9, 2012.

TMI-1's original review of 0E30225 in 2009 assumed that operators would recognize and take action relative to the loss of main feedwater (FW). The original review recognized the applicability and similar vulnerability as described in 0E30225, however, there were no prescribed corrective actions.

TMI-1 main feedwater pump (MFWP) operating status is monitored by pressure switches that sense hydraulic oil pressure at the main feedwater pump turbine. The hydraulic oil pressure is an indication of main feedwater pump turbine operating status and inputs are provided to the Reactor Protection System (RPS) and Heat Sink Protection System (HSPS). With one main feedwater pump turbine operating (providing feedwater flow to the steam generators) and one main feedwater pump turbine in a `reset' condition (satisfactory hydraulic oil pressure is indiciated but is not providing feedwater flow to the steam generators), the Reactor Protection System (RPS) trip and a Heat Sink Protection System (HSPS) actuation associated with a loss of both main feedwater pumps is operationally bypassed.

In the past three years TMI has experienced the above operational condition six times as follows:

01/24/10, amount of time from second MFWP reset until FW flow established: 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 42 min.

05/06/10, amount of time from second MFWP reset until FW flow established: 14 min.

05/31/10, amount of time from second MFWP reset until FW flow established: 39 min.

09/21/10, amount of time from second MFWP reset until FW flow established: 27 min.

11/26/11, amount of time from second MFWP reset until FW flow established: 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 29 min.

05/26/12, amount of time from second MFWP reset until FW flow established: 25 min.

For all six of the above identified conditions the capability to remove residual heat was maintained although automatic actuation of emergency feedwater (EFW) on a trip of the operating main feedwater pump was lost. In all plant conditions, HSPS system would automatically initiate EFW based upon a low water level sensed in either steam generator and, manual actuation capability was maintained.

The six identified operational conditions were not recognized by the operating staff as an entry condition into a one hour technical specification action statement. On May 26, 2012, a planned down-power occurred which required one main feedwater pump to be secured. The Operating crew briefed the Oconee operating experience and discussed actions required to minimize time in this condition.

6 This condition is reportable under 10 CFR 50.73(a)(2)(vii)(B) since a single condition caused two independent trains to become inoperable in a system designed to remove residual heat because a single main feedwater pump in 'reset' bypassed the Emergency Feedwater pump auto start instrumentation for the Heat Sink Protection System.

The condition is also being reported under 10 CFR 50.73(a)(2)(vii)(A) because a single condition caused two independent trains or channels to become inoperable in a single system designed to shut down the reactor and maintain it in a safe shutdown condition. The single condition being when a single main feedwater pump is 'reset' with the other MFWP providing main feedwater flow while reactor power is greater than 7% power, a loss of the running MFWP would not result in an anticipatory reactor trip (ART).

B. CAUSE OF EVENT

The cause of the event was due to an inadequate review of pertinent and applicable operating experience that resulted in continuing station vulnerability to technical specification noncompliance.

The reviewer recognized the vulnerability but did not involve Operations licensed personnel to ensure Technical Specifications were complied with.

C. ANALYSIS / SAFETY SIGNIFICANCE

At no time was the allowed out of service time exceeded during the,six identified operating conditions when the Technical Specification was entered but not recognized.

The anticipatory reactor trip (ART) in the Reactor Protection System (RPS) for the event of loss of main feedwater when greater than 7% reactor power have been added to reduce the number of challenges to the safety valves and power operated relief valve. The ART feature is not credited in the plant safety analysis; it exists to reduce the probability of an overpressure event and challenge to the pressurizer code safety valves.

The Heat Sink Protection System (HSPS) detects low steam generator level and automatically initiates emergency feedwater. In the event that the reported condition in which one MFWP was running and providing main feedwater flow with the second MFWP in a reset condition (bypassing HSPS EFW actuation on loss of main feedwater), a low steam generator level in either steam generator would still actuate the start of emergency feedwater.

Therefore, in the main feedwater pump turbine 'reset' condition, with the RPS trip and a HSPS actuation associated with a loss of both main feedwater pumps operationally bypassed:

o The identified condition (bypass) does not initiate or result in a plant transient such that it could be viewed as a precursor to a significant event.

o There are alternate diverse parameters that sense the loss of feedwater and provide either a reactor trip or EFW actuation such that the identified condition would not lead to a more significant safety concern.

o TMI-1 has not had plant transients or complications to plant operations due to the identified condition such that the performance indicators were impacted let alone exceeded a threshold.

6 o The identified condition is associated with the NRC Reactor Safety cornerstone — mitigation systems by the attribute of configuration control as measured by the operating equipment lineup.

The associated cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences (i.e. core damage) is not adversely impacted as a result of the diverse parameters that sense loss of main feedwater and initiate emergency feedwater.

D. CORRECTIVE ACTIONS

1. Revise response to 0E30225 2. Revise operating procedures to recognize entry into TS condition (including declaring/logging LCO) 3. Evaluate possible modifications/design changes to preclude identified condition 4. Evaluate operator and technical training needs to correct deficiencies 5. Evaluate improvements to Technical Specifications and Bases 3.5.1.9 and Table 3.5-1 section D.

E. PREVIOUS OCCURENCES

TMI-1 recently performed a common cause analysis (CCA 1324039) due to several instances of either not properly identifying Technical Specification Limiting Conditions for Operation times or impacts on station risk during work preparation. From the CCA "Previous Events/OE Review section":

Institute of Nuclear Power Operation (INPO) Operating Experience (OE) database and Exelon's Corrective Action Program (CAP) Passport database were reviewed to find similar events associated with either inadequate LCO identification or understanding impacts of system availability. Several INPO OE items were identified relative to missed LCO and availability requirements due to failed equipment or untimely entry in LCO statements.

Two events associated with not properly identifying LCO action statements at TMI were identified.

Review of these analysis products was used to formulate corrective actions for this analysis.

Previous Events Previous Event Review Apparent Cause Evaluation (ACE) 1123004 Background:

(Late Containment Technical Specification In October 2010, TMI licensed personnelEntry during Reactor River Maintenance) failed to identify the applicability of entry into containment isolation Technical Specifications (TS) during performance of work on the Engineered Safeguards (ES) system Reactor Building Emergency Cooling (RBEC). NRC residents challenged the station approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> into a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> shutdown LCO statement on the missed entry.

Gap with senior reactor operators misapplying understanding of operability and design bases requirements relative to remotely controlled containment isolation valves associated with 6 5

Background:

On 2/21/08, Operations configured the plant such that only one train of Reactor Building Emergency Cooling (RBEC) was available.

TMI-1 TS allows this lineup for a seven day period, however, licensed operators failed to identify the nonconforming condition. During this event, electrical train separation did not exist between the two Reactor Building Air Handling Unit (AH-E-1) fans that were in service. This condition was identified approximately six and half days into a seven day shutdown LCO action statement.

ACE 742762 identified gaps with licensed operators improper interpretation of TS 3.3.3.c relative to three train systems and lack of TS procedural guidance when removing AH-E-1 fans from service.

Review:

Training solution actions and procedure revisions were implemented to ensure compliance with TS 3.3.3.c from ACE 742762.

Specifically, Licensed Operator Requalification Training (LORT) / Initial Licensed Operator Training (ILT) lesson plans were modified and procedure steps addressing RBEC TS requirements were added to procedures that remove AH-E-1 fans from service. Similar training and procedure change actions have been adopted for this analysis.

• Energy Industry Identification System (EllS), System Identification (SI) and Component Function Identification (CFI) Codes are included in brackets, [SI/CFI] where applicable, as required by 10 CFR 50.73 (b)(2)(ii)(F).