05000298/LER-2002-001
| Cooper Nuclear Station | |
| Event date: | 09-18-2002 |
|---|---|
| Report date: | 01-29-2003 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 2982002001R01 - NRC Website | |
PLANT STATUS
Cooper Nuclear Station (CNS) was in Mode 1, Power Operation, at approximately 100 percent power (steady state) at the time of the identified condition.
BACKGROUND
The High Pressure Coolant Injection (HPCI) System [EIIS:BJ] is provided to assure that the reactor is adequately cooled to limit fuel clad temperature in the event of a small break in the nuclear system and loss of coolant which does not result in rapid depressurization of the reactor vessel. The HPCI System permits the nuclear plant to be shutdown while maintaining sufficient reactor vessel water inventory until the reactor vessel is depressurized. The HPCI System continues to operate until reactor vessel pressure is below the pressure at which Low Pressure Coolant Injection [EIIS:BO] operation or Core Spray System [EIIS:BM] operation can be used to maintain core cooling. The HPCI System is also credited during a Station Blackout Event.
Steam which leaks from the HPCI turbine gland seal [EllS:SEAL], stop valve [EIIS:SHV] and governor valve [EIIS:SCV] is routed to the HPCI Gland Seal System. The Gland Seal System functions to prevent the release of the radioactive steam to the environment.
During normal reactor plant operation, the HPCI System, including the Gland Seal System, is in standby.
Upon receiving an initiation signal, the Gland Seal Condenser (GSC) exhauster/blower [EllS:FAN] automatically starts. The steam leakage from the HPCI System turbine seals and steam valve packing is vented to, and condensed in, the gland seal condenser [EIIS:COND]. When the condenser hotwell water level reaches the high water level setpoint, level switches HPCI-LS-356A and 356B [EllS:LS] start the gland seal condenser pump [EllS:13]. The pump returns condensate to the HPCI booster pump suction when HPCI is in operation, or to the reactor building equipment drain sump when the system is in standby. After a 10 second time delay, if the condensate pump has not lowered the condenser water level to the high water level setpoint, the HPCI GSC HOTWELL HIGH LEVEL annunciator [EIIS:ANN] will alarm in the Control Room. When the condenser hotwell level has been reduced to the low level trip set point, the pump automatically shuts off when contacts in HPCI-LS-356B open.
EVENT DESCRIPTION
On September 18, 2002, at 1425 Central Daylight Time (CDT), with Cooper Nuclear Station in Mode 1, Power Operation, at approximately 100 percent power (steady state), the Control Room received Annunciator, "HPCI Gland Seal Condenser Hotwell High Level." The alarm response procedure was reviewed and it was determined the HPCI Gland Seal Condensate Pump should have started and Pump Discharge to Reactor Building Equipment Drain Sump air operated valves [EIIS:V], should have opened.
These automatic actions did not occur. In accordance with the alarm response procedure, the HPCI Auxiliary Oil Pump switch was placed in the Pull-to-Lock (PTL) position. This action prevents the automatic actuation of the HPCI system in response to plant transient and accident initiation signals.
The HPCI system was declared inoperable at 1428 CDT and Technical Specification Section 3.5.1, Emergency Core Cooling Systems - Operating, Limiting Condition for Operation (LCO) Condition C (14 day Completion Time) was entered.
At the time of this event CNS was in LCO 3.5.1, Condition A, with Residual Heat Removal (RHR) sub- system B out of service for scheduled heat exchanger maintenance. This required simultaneous entry into LCO 3.5.1, Condition D (72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time). Maintenance for the RHR heat exchanger was completed and the heat exchanger was declared operable at 1224 CDT on September 20, 2002. Upon completion of repairs and testing, the HPCI system was restored to operable status and the LCO Condition was exited at 1339 CDT on September 20, 2002. CNS was in LCO 3.5.1, Condition C, HPCI inoperable, for approximately 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br />. The actual time that HPCI was unavailable for injection due to the Auxiliary Oil Pump switch being in the PTL position was 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> and 17 minutes.
BASIS FOR REPORT
The procedural response to this event directs that the HPCI Auxiliary Oil Pump switch be placed in the PTL position. This action prevents the automatic actuation of the HPCI system. This condition is reportable per 10CFR50.73(a)(2)(v)(D) as: Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
CAUSE
This event was initiated by the failure of a non-essential level switch. The root cause of declaring HPCI inoperable as a result of the HPCI GSC HOTWELL HIGH LEVEL alarm was the procedure change process in 1993 lacked the necessary rigor to ensure the design function of the Gland Seal Condenser was understood before adding the step to inhibit HPCI.
Review of the procedure change made in 1993 found no technical basis for why it was necessary to prevent HPCI from starting upon receipt of the HPCI GSC HOTWELL HIGH LEVEL alarm. The ability of HPCI to perform its safety function is not dependent upon the operation of the GSC condensate pump or the instrumentation that controls the GSC condensate pump's operation.
A review of safety system alarm response procedures was performed to identify steps which inappropriately render the systems inoperable. Procedures for HPCI, RHR, Core Spray, Reactor Core Isolation Cooling, Automatic Depressurization System, Diesel Generator, Service Water, RHR Service Water, and Control Room Emergency Filter system were included in the review. The review concluded that this condition was limited to the HPCI Gland Seal Condenser High Level Alarm Response Procedure.
SAFETY SIGNIFICANCE
With the HPCI Auxiliary Oil Pump in PTL, and when HPCI was tagged out for repair of HPCI-LS-356B, HPCI was inoperable and unavailable for injection. During the time HPCI was unavailable for injection, Reactor Core Isolation Cooling, the Control Rod Drive System and feedwater were available to provide high pressure core cooling. Additionally, if needed, the Safety Relief Valves (controlled manually or by the Automatic Depressurization System) were available to provide a means to depressurize the reactor pressure vessel so the low pressure systems could provide injection. This condition did not challenge a fuel, reactor coolant pressure, primary containment, or secondary containment boundary, nor did it impact the plant's ability to safely shut down or maintain the reactor in a safe shutdown condition.
HPCI was unavailable for injection for a total of 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> and 17 minutes. Assuming that HPCI was unavailable for 33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br />, the increased core damage probability (ICDP) of this event is 3.54E-08. This ICDP is less than the risk significant threshold of 1E-06. Therefore, this event was not risk significant and would be classified as GREEN.
This condition is reportable per 10CFR50.73(a)(2)(v)(D) as: Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. In accordance with guidance contained in NEI 99-02, Revision 2, Regulatory Assessment Performance Indicator Guideline, this condition is classified as a Safety System Functional Failure.
CORRECTIVE ACTIONS
Immediate Action HPCI-LS-356B was replaced, the HPCI system was restored to operable status and the LCO Condition was exited at 1339 CDT on September 20, 2002.
Long Term Action The alarm response procedure was revised to remove the step to inhibit HPCI which caused this event. The procedure revision was effective on December 27, 2002.
A task analysis was performed to determine if the current plant procedure change process would prevent recurrence of the root cause, or if further corrective actions were required. The analysis concluded that barriers in place, resulting from process improvements to the procedure change process since 1993, are adequate to prevent recurrence.
PREVIOUS EVENTS
cause. The LER reported a condition where premature throttling of Core Spray pump flow could cause the peak cladding temperature limit to be exceeded. In response to NRC Information Notice 89-50, "Inadequate Emergency Diesel Generator Fuel Supply," CNS incorporated procedural guidance to throttle Core Spray pump flow to limit equipment electrical loading on the Diesel Generators. The procedure change and attendant 10CFR50.59 evaluation did not consider LOCA analysis inputs and assumptions and did not address the potential that a clarification may be needed in the procedure to ensure these inputs and assumptions remain valid. The cause of this event was determined to be a failure to establish processes to ensure the appropriate translation of safety analysis inputs and assumptions into plant procedures.
The procedural guidance to throttle Core Spray pump flow was added to the procedure in 1989.
Significant change process improvements have been incorporated at CNS since 1989 which would have prevented this event. The extent of condition review for this event was limited to procedures for systems that could impact Diesel Generator fuel consumption.