05000387/LER-2011-001
| Susquehanna Steam Electric Station Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 3872011001R00 - NRC Website | |
On January 3, 2011, PPL Susquehanna, LLC (PPL) identified a single point vulnerability associated with the steam leak detection system (SLD) (EIIS Code IJ) for Unit 1 and Unit 2. Specifically, PPL determined that the design and setpoint selection for the SLD Delta Temperature function might not be able to accommodate a sudden complete failure of the non-safety related Reactor Building (RB) HVAC heating system temperature controls (EIIS Code VA) during cold weather conditions without causing an isolation of HPCI (EIIS Code BJ), RCIC (EMS Code BN) and main steam lines (EIIS Code SB). This design deficiency had existed since origina l plant design. Additional details concerning the SLD system and the associated single point vulnerability are provided below.
System Description:
The SLD delta T instrumentation consists of a temperature element that measures HVAC inlet air temperature and a temperature element that measures room temperature. The HVAC inlet air temperature is subtracted from the room temperature to obtain a delta T. The HPCI room, RCIC room, and steam tunnel contain separate instruments and each system is isolated by their respective instrument strings when the measured delta T reaches the isolation setpoint. A pre-isolation alarm is also received when the pre-isolation alarm setpoint is reached.
The SLD delta T instrumentation is dependent on proper operation of the Zone I and II RB HVAC heater temperature controller (TC-17589 or TC-27589) during cold weather operation. The Zone I and II RB HVAC heaters are controlled by a single temperature controller (TC17589 for Unit 1, TC27589 for Unit 2) which sends a signal to multiple heater step controllers.
Single Point Vulnerability:
Failure of the temperature controller (TC-17589 or TC-27589) could cause the heaters to turn off. This would cause a decrease in RB HVAC Supply temperature and result in a increase in measured SLD delta T during cold weather. This could have potentially caused an isolation of the MSIVs, HPCI, and RCIC within a short period of time.
Relevant Historical Information:
In 2005, INPO identified a weakness in identifying single point vulnerabilities. In 2006, engineering performed a single point vulnerability analysis for Criticality 1A components. Criticality 1A components are those whose failure alone results in a complete loss of power generation. Since the temperature controllers are Criticality 3 components, they were not evaluated. Criticality 3 components are those whose failure, when combined with another component failure, results in the complete or partial loss of electrical output, in the loss of a safety system function, or the loss of IPE defense-in-depth. In 2007, the engineering staff received training on Failure Modes and Effects analysis.
Previous Occurrences:
One of the root causes of the scram reported in LER 50-387/2006-004 was ineffective failure mode analysis for new modifications. One of the correct condition/prevent recurrence actions was to provide training on different failure modes and effects analyses. The training was focused on performing single failure analysis on new modifications. The SLD issue is a latent, pre-existing single failure issue. A corrective action to perform an FMEA on all non-Q support systems that could cause an isolation of ECCS systems or all the MSIVs is intended to address the latent issues for the more risk significant ECCS systems and loss of the normal heat sink.
CAUSE OF THE EVENT
The cause of the event was a less than adequate single failure analysis performed during the original plant design. The original single failure analysis was consistent with the level of detail of other non-Q system single failure analyses performed at that time. Training on Failure Modes and Effects analysis was provided to Engineering staff in 2007. This training provided expectations as to the level of detail of a failure modes and effects analysis for non-Q systems. Using the guidance from this training, the single point vulnerability was discovered during the preparation of 50.59 determinations for the engineering change to remove the isolation function. In the strict sense of the definition, this represents a deficiency of the previous analysis even though it was consistent with PPL and industry expectations for non-Q systems at that time.
ANALYSIS/SAFETY SIGNIFICANCE
Actual Consequences:
There were no actual consequences from this event. The postulated event was that a postulated failure of the RB HVAC heater controller could cause the SLD delta T instrumentation to isolate the MSIVs, HPCI, and RCIC if outside air temperatures were low enough (less than approximately 10°F). The heater failure never occurred, therefore the potential isolations did not occur and no transient was experienced. The SLD delta T isolations have been removed from the plant; therefore, the potential issue has been resolved.
Potential Consequences:
The postulated event was that a failure of the RB HVAC heater controller could cause the SLD delta T instrumentation to isolate the MSIVs, HPCI, and RCIC if outside air temperatures were low enough (less than approximately 10°F). For a system isolation to occur, the heater controller had to fail and concurrently the outside air temperature had to be below approximately 10°F. Outside air temperatures of less than approximately 10°F have been reported eleven times in the last two years. Incorporation of these new isolation events into the risk model resulted in very small changes to the CDF and LERF. Based on this information, the potential safety impact of the reported event was insignificant. The SLD delta T isolation functions have been removed from the plant; therefore the potential issue has been resolved.
CORRECTIVE ACTIONS
The following corrective action has been completed:
- A modification to eliminate the isolation function of the Steam Leak Detection delta T instrumentation was implemented.
The following corrective action is planned:
- Perform a Failure Modes and Effects Analysis (FMEA) on all non-Q support systems that could cause an isolation of EGGS systems or all the MSIVs.
No regulatory commitments are associated with this report.