05000335/LER-2011-003, Regarding Long-Term Post-LOCA Hot Leg Injection Single Failure Vulnerability
| ML12023A003 | |
| Person / Time | |
|---|---|
| Site: | Saint Lucie  |
| Issue date: | 01/03/2012 |
| From: | Richard Anderson Florida Power & Light Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-2011-562 LER 11-003-00 | |
| Download: ML12023A003 (7) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(ii) |
| 3352011003R00 - NRC Website | |
text
0 FPL Florida Power & Light Company, 6501 S. Ocean Drive, Jensen Beach, FL 34957 January 3, 2012 L-2011-562 10 CFR 50.73 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C. 20555 Re:
St. Lucie Unit I Docket No. 50-335 Reportable Event: 2011-003 Date of Event: November 3, 2011 Long-Term Post-LOCA Hot Leg Injection Single Failure Vulnerability The attached Licensee Event Report 2011-003 is being submitted pursuant to the requirements of 10 CFR 50.73 to provide notification of the subject event.
Respectfully, Richard L. And'r~son Site Vice President St. Lucie Plant RLA/KWF Attachment 17 an FPL Group company
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/201" (10-2010)
Estimated burden per response to comply with this mandatory collection request: 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />. Reported lessons learned are incorporated into the licensing process and fed back to industry. Send comments regarding burden estimate to the Records and FOIA/Privacy Service Branch (T-5 LICENSEE EVENT REPORT (LER)
F52), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to infocollects@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 13. PAGE St. Lucie Unit 1 05000335 1 OF 6
- 4. TITLE Long-Term Post-LOCA Hot Leg Injection Single Failure Vulnerability
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE 1
- 8. OTHER FACILITIES INVOLVED SEQUENTIALYEAREVEQUETHIALYREEAR FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR NUMBER RV MONTH DAY YEAR.
na iFACILITY NAME DOCKET NUMBER 11 03 2011 2011 003 00 01 03 2012J na
- 9. OPERATING MODE
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply)
El 20.2201(b)
El 20.2203(a)(3)(i)
EJ 50.73(a)(2)(i)(C)
E] 50.73(a)(2)(vii) 1E 20.2201(d)
El 20.2203(a)(3)(ii)
El 50.73(a)(2)(ii)(A)
El 50.73(a)(2)(viii)(A)
El 20.2203(a)(1)
El 20.2203(a)(4) 0 50.73(a)(2)(ii)(B)
El 50.73(a)(2)(viii)(B)
E] 20.2203(a)(2)(i)
[I 50.36(c)(1)(i)(A)
El 50.73(a)(2)(iii)
El 50.73(a)(2)(ix)(A)
- 10. POWER LEVEL E] 20.2203(a)(2)(ii)
El 50.36(c)(1)(ii)(A)
El 50.73(a)(2)(iv)(A)
El 50.73(a)(2)(x)
E3 20.2203(a)(2)(iii)
El 50.36(c)(2)
[] 50.73(a)(2)(v)(A)
E] 73.71(a)(4)
E] 20.2203(a)(2)(iv)
El 50.46(a)(3)(ii)
E3 50.73(a)(2)(v)(B)
El 73.71(a)(5) 85%
El 20.2203(a)(2)(v)
El 50.73(a)(2)(i)(A)
El 50.73(a)(2)(v)(C)
El OTHER E] 20.2203(a)(2)(vi)
El 50.73(a)(2)(i)(B)
[
50.73(a)(2)(v)(D)
Specify in Abstract below or in failures in the HLI flow path, and 3) the alternate HLI flow through the regenerative heat exchanger would exceed the heat exchanger shell side design flow rate.
The required jumpers were fabricated and required procedure changes implemented.
The functional but degraded condition is being tracked as an open RIS 2005-20 issue.
St. Lucie determined that crediting unproceduralized manual actions for maintaining the HLI flow paths as fully operable was non-conservative with respect to RIS 2005-20, revision 1. Furthermore, the discovery of additional jumper scope and the potential effects of postulated HLI flow on the integrity of the regenerative heat exchanger during the EPU alternate HLI flow path design modification called into question the 1999 CR assertion that the emergency response organization would be successful initiating HLI within the required time frame, given a loss of power.
Based on the above, this condition is reportable.
Cause of the Event
The original single failure vulnerability is a legacy design issue.
The failure to implement effective contingency measures once the single failure vulnerability was identified was due to two issues.
The first issue was the inadequate operability assessment in the 1999 CR.
This CR concluded that the HLI function remained fully operable without the need to proceduralize the required jumpers.
Additionally, the engineering rigor applied to the FMEA was inadequate.
A 1970's vintage Combustion Engineering letter was used to develop the required jumper scope; this over-reliance on vendor input led to the inadequate FMEA that did not identify the full scope.
The lack of rigor in operability assessments (now referred to as prompt operability/functionality determinations) is considered a legacy human performance issue.
An extent of condition review was performed by reviewing the condition reports for the past five years.
No issues were found that invalidated the conclusions of the prompt operability/functionality determinations.
Additionally, the NextEra Energy (NEE) Fleet procedure platform revised the fleet operability procedure in 2008.
The newer process is more formal than the freefo rm operability assessment performed in 1999, and engineering department personnel have had recent training on the subject.
The second issue that led to the failure to implement effective contingency measures (and represents the second opportunity for discovery) was the inadequate screening of the 2008 CR that documented the untimely corrective actions for the 1999 CR.
The 2008 CR was screened as an administrative issue with no plant impact because of the referenced 1999 CR disposition.
The CR initial screening team failed to recognize the significance of crediting non-proceduralized manual actions for continued operability.
Had the NEE fleet prompt operability determination process been utilized in 2008, this condition would have been classified as functional but degraded and the manual actions needed as compensatory measures would have been proceduralized during the prompt operability/functionality determination process.
Subsequent to the 2008 CR, the St. Lucie corrective action program (CAP) was significantly revised as a result of the NRC 95002 inspection following 2008/2009 component cooling water (CCW) air intrusion events.
The CR initial screening team and management review committee methods were revised to ensure that CR screening categorization and classification are based on nuclear safety and risk.
An extent of condition review was performed on similar CRs screened as administrative in nature
over the last five years, and none were found that had unresolved safety issues.
These corrective actions became effective after the 2008 HLI CR.
Analysis of the Event
This condition is reportable pursuant to 10 CFR 50.73(a) (2) (ii)
(B) as any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.
NUREG-1022 states that the discovery of a system that does not meet the single failure criterion is reportable under this section.
The NRC SER clearly stated that no single failure would prevent HLI, but the current design requires the use of jumpers to mitigate single failure scenarios.
Additionally, this condition is reportable pursuant to 10 CFR 50.73(a) (2) (v) as any condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
NUREG-1022 states that it is not required to postulate an additional random single failure in the system.
However, only one single failure would be necessary to prevent hot leg injection, a required long-term cooling safety function.
This condition is not applicable to St. Lucie Unit 2 as it has a dedicated HLI flow path as part of its original design.
Analysis of Safety Significance The mechanism for potential boron precipitation is as follows.
For a hot leg break, the injection flow passes from the cold legs, through the core, into the hot legs, and out the break.
So, for a hot leg break, core heat removal is via forced flow of the injection water.
In contrast, for a cold leg break, after the reflooding is completed, the hydraulic balance will cause most of the injection flow to spill out of the break - the only flow into the core will be that required to make-up for the boil-off in the core that removes the core decay heat.
The boron problem arises only during a cold leg break; as borated injection flow enters the core, and only pure water (as steam) leaves the core, the boron concentration in the core region will continue to increase.
Once the boron concentration exceeds the solubility limit the boron will precipitate and challenge long-term core cooling capability.
The solution to the potential problem is to achieve subcooled flow through the core: when boron in equals boron out, the concentration will not be increasing.
St. Lucie uses simultaneous hot and cold leg injection as the method to achieve forced flow through the core for long-term post-LOCA cooling.
With simultaneous hot and cold leg injection, the recirculated sump fluid is injected into the hot legs as well as the cold legs.
Regardless of break location, approximately half of the flow will pass through the core on its way to the break (the flow to the side with the break simply spills directly out of the break into containment, contributing nothing).
In order to preclude boron precipitation, the operators are procedurally required to initiate HLI within four to six hours post-LOCA.
The original St. Lucie Unit 1 Operating License HLI analysis required initiation of long-term post-LOCA cooling within 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> of the event.
FPL committed to initiating HLI within ten hours to preserve the analysis.
In 1993, the boron concentration in the boric acid makeup tanks was reduced, and this unofficially increased the initiation of long-term post-LOCA cooling up to 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> after the event.
In 1999, the HLI analysis of record was revised to incorporate the NRC accepted CENPD-254-P-A, "Post-LOCA Long Term Cooling Evaluation Model," and the time limit for HLI initiation was reduced from 32 to ten
hours.
In addition to the maximum time limit to preclude boron precipitation, decay heat and steam formation in the reactor head render HLI flow through the hot leg ineffective for the first four hours post-LOCA; this concern is addressed by the procedural initiation of HLI after the first four hours.
In 2003, the St. Lucie reload analysis added a return to criticality aspect to the HLI analysis.
This cycle specific calculation required that HLI be initiated within seven to ten hours to preclude a return to criticality.
Once the conservatisms are removed from the return to criticality calculation, the boron precipitation time limit of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> becomes bounding.
Based on this, after waiting for the first four hours post-LOCA for HLI flow through the hot leg to become effective, the operators had an approximate six hour window to initiate HLI.
If there was a loss of an electrical bus, even without procedures, the emergency response organization (ERO) problem solving teams in the technical support center (TSC) and emergency response facility (ERF) would be looking ahead and would come to the conclusion that jumpers would be needed to initiate HLI.
Additionally, the ERO may need to diagnose and mitigate regenerative heat exchanger tube failures if the alternate HLI flow path was used.
Because such actions would be knowledge-based instead of rule-based, there is a small probability that HLI would not be initiated in time to preclude boron precipitation, even with the consideration of the relatively long time period needed to establish HLI flow.
A probabilistic safety assessment is being performed to determine the risk associated with the ERO directed actions and jumper fabrication needed to mitigate the failure scenarios.
The LER supplement will include the results of this assessment.
.Corrective Actions The corrective actions listed have been entered into the site CAP.
Any changes to the actions below will be processed in accordance with the CAP'.
- 1. The required jumpers were fabricated and required procedure changes implemented.
The functional but degraded condition is being tracked as an open RIS 2005-20 issue.
- 2.
The appropriate long-term solution to the HLI failure vulnerabilities will be implemented no later than the end of the SLI-25 refueling outage.
- 3. The improvements to the St. Lucie CAP are as described in LER 50-335/2010-001-01, "Air Intrusion From 1A Containment Instrument Air Compressor Into Unit 1 Component Cooling Water (CCW)
System."
Similar Events
LER 50-335/2010-001-01, "Air Intrusion From 1A Containment Instrument Air Compressor Into Unit 1 Component Cooling Water (CCW)
System."
This event was the onus for the St. Lucie CAP improvements driven by the NRC 95002 inspection on CCW air intrusion events.
The causes for the CCW air intrusion event that are applicable to and bound the current LER on HLI single failure issue include the organization and programmatic weaknesses that existed in the areas of prompt identification, understanding of event significance, and timely corrective actions.
As such, the corrective actions for the CCW air intrusion event bound the HLI single failure event.
Failed Components None