05000247/LER-2007-005
| Indian Point 2 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 2472007005R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {1.
DESCRIPTION OF EVENT
On November 8, 2007, at approximately 17:30 hours, while at 100% steady state reactor power, Technical Specification (TS) 3.5.2, "Emergency Core Cooling Systems (ECCS)," Condition A was entered for one or more trains inoperable. TS 3.5.2 was entered as a result of an extent of condition review finding for a condition discovered by the NRC during a Unit 3 Component Design Basis NRC Inspection (CDBI) where a unit 3 Internal Recirculation {BP} pump {P} (IRP) was determined to be inoperable. During the Unit 3 CDBI design review of the Internal Recirculation System (IRS), a condition was identified in which an IRP would become inoperable during operator response actions for certain Reactor Coolant System (RCS) small break sizes (less than 3 inches) [Small Break Loss of Coolant Accidents (SBLOCAs)]. The condition is due to a weak pump/strong pump interaction where the stronger pump would shut the discharge check valve {V} of the weaker pump causing it to dead head. The dead head condition would result in a less than acceptable flow rate through the weak pump causing it to become inoperable. On November 9, 2007, at 20:22 hours, TS 3.5.2 was exited for the inoperable train of ECCS. The Unit 2 condition was recorded in the Indian Point Corrective Action Program (CAP) as CR-IP2-2007-04558. The Unit 3 condition as recorded in the CAP as CR-IP3-2007-04212. An additional concern identified by the NRC was the basis for IRP minimum flow acceptability. This concern is being addressed in CR-IP3-2007-4296. Corrective actions under CR-IP3-2007-04212 will verify manufacturer minimum flow acceptance criteria for all applicable safety pumps and confirm the validity of the evaluation of pertinent pump operating conditions.
The Recirculation System (IRS) is one of three subsystems of the ECCS that is composed of two 100% capacity subsystems with one pump for each subsystem.
The other two subsystems are the High Head Safety Injection System (HHSIS) {BO composed of three 50% capacity subsystems which share two pump discharge headers, with one pump for each subsystem, and the Residual Heat Removal System (RHRS) {BP} composed of two 100% subsystems with one pump for each subsystem. After the injection phase post LOCA, the coolant spilled from the break and collected in the containment {NH} recirculation sump is cooled and returned to the RCS {AB} by the IRS. During this recirculation phase of a LOCA recovery, the IRPs take suction from the containment recirculation sump and direct flow through the RHR heat exchangers {HX} to the Reactor Coolant System (RCS). The RHR Pumps can be used to provide a backup method of recirculation but would take suction from a separate containment sump. For SBLOCAs where the recirculated sump water must be injected against higher pressures, the HHSI pumps are used to augment the flow-pressure capacity of the IRPs in returning spilled coolant to the reactor. The high head external recirculation flow path via the HHSI pumps is only required for the range of break sizes for which the RCS pressure remains in excess of the shutoff head of the IRPs.
Cause of Event
The cause of the condition was inadequate analysis during original plant design due to insufficient engineering rigor which failed to identify the strong pump/weak pump interaction of the IRPs for SBLOCAs. Previous evaluations of internal recirculation operating scenarios were not rigorous enough in that they did not fully evaluate IR pump conditions for SBLOCA. Procedures were developed based on the plant design that introduced a potential condition in which an IRP could fail. The Emergency Operating Procedures (ES-1.3 and ES-1.4) included a requirement to start a second IR Pump during the recirculation phase of a SBLOCA.
Corrective Actions
The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the
- cause and prevent recurrence:
- Procedures ES-1.3 and ES-1.4 were revised to preclude operating two IRPs in parallel during High Head recirculation scenarios.
- An UFSAR revision was prepared to reflect the changes to the steps for the post LOCA switchover and processed for inclusion in the next scheduled revision of the UFSAR.
- A review of other applicable safety related pumps will be performed for potential impact from strong pump/weak pump interactions and any necessary action taken.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(i)(B). The licensee shall report any operation or condition which was prohibited by the plant TS. The Action Statement for the ECCS Technical Specification (TS) Limiting Condition for Operation (LCO), TS 3.5.2 requires three trains of ECCS to be operable. The required action A.1 for TS 3.5.2 Condition A, One or more trains inoperable, is to restore the train(s) to operable within a completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
This event meets the reporting criteria because an IR pump was determined to be inoperable under certain SBLOCA scenarios and that the condition was applicable during past operation. The time in which the condition existed during past operation was from initial plant operation.
The inoperable condition during past operation exceeded the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed outage time (AOT) for TS 3.5.2 and the required actions were not performed. Based on the original FSAR Section 6.2 which contains switchover sequence directions to start the second IRP, the condition existed from initial plant operation. During the time the IRP was inoperable, the redundant IRP was operable and available to perform the safety function. During past operation when a train was inoperable (e.g., testing/maintenance), the weak pump/strong pump interaction would not be applicable and the redundant train would have been fully functional. In accordance with reporting guidance in NUREG-1022, an additional random single failure need not be assumed in that system during the condition. Therefore, there was no safety system functional failure of the IRS reportable under 10 CFR 50.73(a)(2)(v) for the strong pump/weak pump interaction. Review of the condition for reporting under 10 CFR 50.73(a)(2)(ii)(B), "Any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety," determined the event is not 'reportable under this criterion. Engineering judgment, as allowed by the guidelines of NUREG-1022, concluded that there is reasonable expectation that the safety function of the ECCS could be fulfilled (e.g., availability of RHR).
NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001) FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)
Past Similar Events
A review was performed of Licensee Event Reports (LERs) for the past three years for any events due to inadequate design analysis. There were two LERs identified that reported events that were similar to the cause for this event. LER-2006 007, reported a TS prohibited condition due to inoperable containment isolation valves for the containment pressure relief line as a result of a poor design of a retaining clip that allowed a valve stroke to greater than the TS allowed 60 degrees open. LER-2005-002, reported a TS prohibited condition due to exceeding the TS AOT for one train of ECCS caused by an inoperable SI pump as a result of gas intrusion. The cause was a latent organizational weakness which did not consider gas intrusion into the SI pump a credible event. Engineering was narrowly focused and not rigorous in their decision process.
Safety Significance
This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents. Also, the ECCS design is robust in that the RHRS provides a backup capability to the IRS and at least one RHR train would have been available during the time a IRP pump was potentially inoperable. As noted in FSAR Section 6.2, the RHRS provides a backup recirculation capability. Under postulated accidents that are discussed in FSAR Section 14.2, the analyzed LOCAs assume a loss of offsite power and a single failure disabling one ECCS train. This analyzed condition would result in only one train of IRS thereby preventing the potential for a strong pump/weak pump interaction.
An assessment was performed to determine the impact of the condition on Core Damage Frequency (CDF). The assessment of the IRP strong pump/weak pump interaction issue determined there would be a change in internal events CDF of no more than 5E-7 per year. That CDF impact is considered not significant (Green Band, delta CDF generally has little impact on large early release frequency, the controlling concern was the impact on CDF.