05000282/LER-2009-004
| Prairie Island Nuclear Generating Plant (Pingp) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 2822009004R01 - NRC Website | |
On December 16, 2008 Prairie Island Nuclear Generating Plant (PINGP) performed ultrasonic testing measurements on residual heat removal (RHR) piping susceptible to void formation in order to address gas accumulation concerns mentioned in Generic Letter (GL) 2008-01. A void was found on the common line from the Unit 1 Reactor Coolant System (RCS) hot leg piping to both of the RHR pump suctions. An engineering analysis determined that operability of the RHR system was not affected by this void.
In March 2009, based on the past operability analysis performed for the December 16, 2008 void and an operating experience (OE) report from Wolf Creek dated October 2008, PINGP concluded that the RHR system piping in both units would be vulnerable to void formation under certain plant conditions and must be considered inoperable under those conditions. High temperature water in the RHR system has a potential to flash to steam during a loss of coolant accident (LOCA) scenario during heat-up in Mode 3 (Hot Standby) or during heat-up or cooldown in Mode 4 (Hot Shutdown). When the RHR water temperature is above 226 degrees F in Modes 3 or 4, steam voids could potentially form and transport to the RHR pump suction which would render the pump inoperable. As a result, the RHR system must be considered inoperable any time the RHR system temperature was above 226 degrees F in Modes 3 or 4.
On April 6, 2009 PINGP engineering personnel evaluated the applicability of the potential void formation conditions described by the March 2009 past operability analysis. Engineering personnel determined that within the previous three years the RHR system was sufficiently cool before entering Mode 3 such that inoperability while in Mode 3 was not a concern for either Unit 1 or Unit 2.
However, within the previous three years there were multiple identified occurrences where, while in Mode 4, RHR system temperature was greater than 226 degrees F which rendered both trains of the RHR system inoperable.
In Mode 4, a flow path is required to provide recirculation flow via the RHR subsystem from the containment sump into each of the reactor vessel upper plenum nozzles. The inoperability of both trains of the RHR system under the described condition would cause a loss of safety function for the RHR system. Thus, this condition is reportable under 10 CFR 50.73(a)(2)(ii)(B) for being in an unanalyzed condition that significantly degrades plant safety, 10 CFR 50.73(a)(2)(v)(B) as a condition that could have prevented fulfillment of a safety function, and 10 CFR 50.73(a)(2)(vii) due to the common cause inoperability of two independent trains in the same system.
In July, 2010, the operability of the RHR system during a Mode 4 Large Break LOCA with both trains of the RHR system operating for shutdown cooling was questioned and additional engineering analysis was conducted. It was determined that this additional RHR potential failure mode was reportable under the above criteria.
1 EIIS System Identifier: BP In 1993, Westinghouse completed an industry evaluation concerning the potential for water to flash to steam in the RHR pump suction line. Nuclear Safety Advisory Letter (NSAL)93-004 recommended that plant operating procedures be reviewed to verify that the potential for forming steam voids was precluded. One option presented was to force cool the piping. Since PINGP procedures use forced cooling, it was concluded that the guidance had been met. However, it appears that both the preparer and reviewer of the response to NSAL-93-004 failed to recognize that the forced cooling line returns too close to the RHR pump suction to effectively cool all of the RHR suction piping.
Additionally, NSAL-93-004 did not provide recommendations for protecting one train of RHR for Emergency Core Cooling Systems (ECCS) function while in Mode 4.
The issuance of GL 2008-01 by the NRC and an industry OE report by Wolf Creek prompted PINGP staff to analyze the potential vulnerabilities of the RHR system during an ECCS actuation for a LOCA.
If a steam void is entrained into the RHR pump suction, the pump could become inoperable.
A calculation was done to determine the maximum allowable RHR temperature to preclude void formation in the RHR pump suction header. The temperature was determined to be the saturation temperature of the fluid for the minimum pressure that would be present at the RHR pump suction header. This pressure was determined by considering the static head of and ambient pressure on the fluid supplied to the pump, sump strainer losses, and piping losses affecting the system. Due to this minimum pressure, maximum temperature allowable at the RHR hot leg suction was determined to be 226 degrees F.
The April 6, 2009 past operability review by engineering personnel determined that the total time over the previous three years that Unit 1 RHR would have been inoperable due to this condition was 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br />, 40 minutes, with the longest single inoperability being, 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br />, 28 minutes. The total time that Unit 2 RHR would have been inoperable due to this condition was 77 hours8.912037e-4 days <br />0.0214 hours <br />1.273148e-4 weeks <br />2.92985e-5 months <br />, 43 minutes, with the longest single inoperability being 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />, 8 minutes.
Additional engineering analysis determined that if a LOCA occurred in Mode 4, it cannot be assured that the RHR pumps operating for shutdown cooling would have functioned for ECCS. If the LOCA was of sufficient size to depressurize and drain the RCS, any operating RHR pump would lose its suction source. As a result, any operating RHR pump was assumed to have failed during a postulated Mode 4 LOCA. This did not align with Technical Specifications (TS) 3.5.3, Note 1, that allowed a RHR pump to be considered Operable for ECCS while it was aligned and operating for shutdown cooling. The RHR system is required by TS for ECCS when the indicated RCS cold leg temperature exceeds 218 degrees F.
and 20 minutes for Unit 2 were identified in which TS 3.5.3 was not met for the three years prior to July 22, 2010. The additional 5 minutes on Unit 1 was from the occurrence on February 13, 2008, which changes that occurrence from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 41 minutes to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 46 minutes. The additional 20 minutes on Unit 2 was from the occurrence on September 20, 2008, which changes that occurrence from 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 43 minutes to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 3 minutes.
Both trains of RHR being rendered inoperable during the conditions described above represents a safety system functional failure under 10 CFR 50.73(a)(2)(v)(B).
SAFETY SIGNIFICANCE
The potential existed during Mode 4 for either a forced outage or refueling outage that the RHR system would not have functioned as designed during a LOCA. At Mode 4, RCS temperature is maintained between 200 degrees F - 350 degrees F and pressure is maintained below 425 psig before the RHR system is placed in-service. At these temperatures and pressures, which are well below Mode 1 values, the probability of occurrence of a design basis accident is reduced.
In the event that the RHR system became inoperable, abnormal and emergency procedures would provide guidance to restore cooling to the core. When the plant is in Mode 4 and above 218 degrees F, a safety injection pump would be available to provide flow to the RCS in a timely manner and the RHR pumps need not be relied on for short-term LOCA mitigation. With the high head Safety Injection (SI) pump operating, the refueling water storage tank water inventory would eventually deplete causing the need for recirculation. During this time, should steam binding of the RHR pumps occur, the operating SI pump would have no suction source from the RHR pump discharge.
However, the charging system would be available to provide highly borated water via emergency boration. Finally, steam generators and auxiliary feedwater would also be available to remove decay heat if needed.
There were no actual consequences to the health and safety of the public and the safety significance of this event is considered minimal.
CAUSE AND CORRECTIVE ACTIONS
The cause for this declared inoperability was the failure of PINGP procedures to adequately support all functions of RHR operation in Modes 3 and 4 without impacting one another. Additional causes include the failure to adequately address Westinghouse NSAL-93-004 in 1993 and the failure to take long term corrective actions to prevent voiding after the water hammer event at PINGP in 1999.
A formal calculation of the allowable RHR water temperature has been completed. Based on the results of the calculation, procedures were revised to manage RHR void formation. In addition, procedures were further revised based on the additional items identified in July, 2010. The site's process for submitting a License Amendment Request has been initiated to revise the TS.
On January 9, 1999, preparations were made to place RHR in service for plant cooldown. When the isolation valve between the hot leg and RHR pump suction was opened, the valve stopped after approximately one quarter travel. Operators observed a pressurizer level and pressure decrease.
The likely cause of this transient was water hammer created when RCS water collapsed a void in the common RHR hot leg suction piping.
The report for this non-conformance concluded that this void was formed as a result of operating procedures in Modes 3 and 4. Short term corrective actions included an addition to procedures to eliminate the possibility of water hammer by filling the line before placing shutdown cooling in service.
However, long term corrective actions were not completed to eliminate the voiding of the hot leg suction line.