05000413/LER-2006-003
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4132006003R00 - NRC Website | |
BACKGROUND
This event is being reported under the following criteria:
10 CFR 50.36(c)(2)(i), Limiting Condition for Operation not met; and 10 CFR 50.73(a)(2)(i)(B), any operation or condition which was prohibited by the plant's Technical Specifications.
Catawba Nuclear Station Units 1 and 2 each is a Westinghouse four-loop Pressurized Water Reactor (PWR) [EIIS: RCT].
The Hydrogen Ignition System (HIS) [EIIS: BB] reduces the potential for breach of primary containment due to a hydrogen oxygen reaction following a beyond Design Basis Accident (DBA). The HIS is required by 10 CFR 50.44, "Standards for Combustible Gas Control Systems in Light Water-Cooled Reactors", and 10 CFR 50, Appendix A, General Design Criterion 41, "Containment Atmosphere Cleanup", to reduce the hydrogen concentration in the primary containment following a degraded core accident. The HIS must be capable of handling an amount of hydrogen equivalent to that generated from a metal water reaction involving 75% of the fuel cladding surrounding the active fuel region.
The HIS is based on the concept of controlled ignition using thermal ignitors, designed to be capable of functioning in a post-accident environment, seismically supported, and capable of actuation from the control room. A total of 70 ignitors are distributed throughout the various regions of each Catawba unit's ice condenser containment in which hydrogen could be released or to which it could flow in significant quantities. The ignitors are arranged in two independent trains such that each containment region has at least two ignitors, one from each train, controlled and powered redundantly so that ignition would occur in each region even if one train failed to energize.
When the HIS is initiated, the ignitor elements (Catawba presently utilizes Tayco Model 3442 glow coils as the ignitor elements) are energized and heat up to a surface temperature > 1700°F. At this temperature, they ignite the hydrogen gas that is present in the airspace in the vicinity of the ignitor. The HIS depends on the dispersed location of the ignitors so that local pockets of hydrogen at increased concentrations would burn before reaching a hydrogen concentration significantly higher than the lower flammability limit.
Hydrogen ignition in the vicinity of the ignitors is assumed to occur when the local hydrogen concentration reaches 8.5 volume percent (v/o) and results in 100% of the hydrogen present being consumed.
The hydrogen ignitors have been shown by probabilistic risk analysis to be a significant contributor to limiting the severity of accident sequences that are commonly found to dominate risk for units with ice condenser containments. As such, the hydrogen ignitors meet the criteria contained in 10 CFR 50.36 for inclusion in plant Technical Specifications.
Technical Specification 3.6.9 governs the HIS. Limiting Condition for Operation 3.6.9 requires two HIS trains to be operable. With one HIS train inoperable, Condition A requires the inoperable train to be restored to operable status within 7 days or Surveillance Requirement 3.6.9.1 (energize each HIS train power supply breaker and verify > 34 ignitors are energized in each train) must be performed on the operable train once per 7 days. If this is not done, Condition C requires the unit to be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. There is no Condition for two inoperable HIS trains; therefore, Limiting Condition for Operation 3.0.3 applies in this situation. Surveillance Requirement 3.6.9.3 requires, on an 18-month basis, that each hydrogen ignitor is energized and the temperature is verified to be > 1700°F. Surveillance Requirement 3.6.9.3 is performed using procedures IP/1&2/A/3170/001, "Hydrogen Mitigation System (EHM) Ignitor Temperature Check". Ignitor temperature is measured using the Capintec Hot Shot Pyrometer [EMS:
PYRO]. In order to account for measurement uncertainty, the actual procedural acceptance criterion for Surveillance Requirement 3.6.9.3 is 1737°F.
When the initial Technical Specification violation was discovered on 12/15/06, Unit 1 was in No Mode during its end-of-cycle 16 refueling outage and Unit 2 was in Mode 1 at 100% power. Throughout the time period encompassing the Technical Specification violations, Units 1 and 2 had been in both operating and shutdown modes. Except as described in this LER, no structures, systems, or components were out of service or had been out of service that had any effect on the HIS.
EVENT DESCRIPTION
(Certain event times are approximate.) Date/Time � Event Description 2004 timeframe Fall 2004 Spring 2005 11/30/06/1053 Plant modifications were developed to replace the HIS ignitor elements for Unit 1 and Unit 2.
The HIS had previously utilized glow plugs as the ignitor elements. The modification replaced the glow plugs with Tayco Model 3442 glow coils, which were being successfully utilized at other ice condenser plants.
The glow coils were installed as replacement HIS underwent post-modification testing following completion of the modification.
The glow coils were installed as replacement HIS underwent post-modification testing following completion of the modification.
Problem Investigation Process (PIP) C-06-08140 was written concerning ignitor temperature measurements taken on 11/24/06 during the Unit 1 end-of-cycle 16 refueling outage. The PIP discussion focused on engineering and maintenance technician knowledge of the Capintec Hot Shot Pyrometer, which was being used to measure ignitor temperature. The Capintec Hot Shot Pyrometer was sent offsite for recalibration. Based on the issues that were known at the time, the PIP operability assessment concluded that all Unit 2 ignitors were operable. This conclusion was subsequently determined to have been incorrect.
12/08/06/1542 � Unit 1 ignitor temperature measurements were taken with the recalibrated Capintec Hot Shot 12/15/06/1913 12/16/06/0059 12/24/06/1113 12/27/06/---- An operability assessment concluded that the Unit 2 HIS was not affected by the fuse issue identified on Unit 1. Only HIS Train 1B was determined to be retroactively inoperable.
Post-event An Event Investigation Team was chartered to investigate the issues associated with the Unit 1 and Unit 2 HIS.
CAUSAL FACTORS
The root cause of this event was determined to be twofold:
1. There was a lack of monitoring and oversight of engineering worker practices associated with the modifications to replace the HIS ignitor glow plugs with glow coils. This allowed an informal reliance on experienced personnel to ensure some critical aspects of the design were adequate, which resulted in an incomplete analysis and an incomplete independent review of all aspects of the modifications.
2. The measuring and test equipment process did not adequately integrate critical operating characteristics important to the accuracy of the Capintec Hot Shot Pyrometer into maintenance procedures or maintenance training.
The combination of these two root causes resulted in inadequate assurance that the replacement ignitors in the ice condenser regions for HIS Trains 1A, 1B, and 2A could achieve the 1700°F temperature required by Surveillance Requirement 3.6.9.3 following implementation of the modifications. The duration of time that the affected ignitors could not meet the surveillance requirement could not be conclusively determined; therefore, it is conservatively assumed that the duration began upon implementation of the modifications.
In addition, engineering did not properly size fuses in the HIS due to a lack of fundamental knowledge that the fuse sizing requirements were contained in the electrical criteria.
CORRECTIVE ACTIONS
Immediate:
1. Technical Specification 3.6.9, Condition A was entered for HIS Train 2A upon discovery that the affected ignitors in the ice condenser regions did not meet the Surveillance Requirement 3.6.9.3 acceptance criterion.
Subsequent:
1.Following the discovery of the low ignitor temperature readings in the ice condensers, voltage regulator adjustments were made for HIS Trains 1A, 1B, and 2A. Surveillance Requirement 3.6.9.3 was then successfully performed for all affected ignitors.
2.The improperly sized fuses in the HIS were replaced with fuses of a higher rating.
3.An Event Investigation Team was chartered to investigate the issues associated with the Unit 1 and Unit 2 HIS.
Planned:
1.Management will take steps to enhance monitoring and oversight of engineering worker practices related to modifications.
Specific areas for consideration include responsibilities of the preparer and checker, independence of checking activities, reliance on experienced personnel, and ensuring required aspects of a design are properly addressed and independently reviewed.
2.Critical characteristics necessary to perform accurate ignitor temperature measurements using the Capintec Hot Shot Pyrometer will be determined. This information will be incorporated into procedures and training prior to the Unit 2 end-of-cycle 15 refueling outage.
3.Specific information related to the use of design criteria regarding fuse sizing will be incorporated into group specific training.
There are no NRC commitments contained in this LER.
SAFETY ANALYSIS
The function of the HIS is to cause hydrogen in containment to burn in a controlled manner as it accumulates following a degraded core accident. Burning is designed to occur near the lower flammability concentration, where the resulting temperatures and pressures are relatively benign. Without the system, hydrogen could build up to higher concentrations that if ignited could result in a containment pressure spike high enough to challenge containment integrity. The HIS is not required for the mitigation of DBAs, such as a Loss of Coolant Accident (LOCA), because the amount of hydrogen generated with success of the emergency core cooling systems is much smaller than the amount produced from the reaction of 75% of the fuel cladding with water. The HIS has been shown by probabilistic risk analysis to be a significant contributor to limiting the severity of accident sequences that dominate risk for units with ice condenser containments. For this reason, the HIS is included in Technical Specifications as required by 10 CFR 50.36, Criterion 4.
Surveillance Requirement 3.6.9.3 specifies that all ignitors, including normally inaccessible ignitors, are visually checked for a glow to verify that they are energized. Additionally, the surface temperature of each ignitor is measured to be � 1700°F to demonstrate that a temperature sufficient for ignition is achieved. The 1700°F temperature is a surveillance requirement parameter. Section 3.8 of "An Analysis of Hydrogen Control Measures at McGuire Nuclear Station", which is also applicable to Catawba, identifies that the required normal operation temperature is 1500°F. Therefore, based upon ignitor performance testing conducted at Catawba, the surveillance requirement of 1700°F ensures that sufficient margin is present for continued hydrogen ignition under degraded bus conditions. In order to account for measurement uncertainty, the actual procedural acceptance criterion for Surveillance Requirement 3.6.9.3 is 1737°F. During this event, the minimum ignitor temperature recorded by the Capintec Hot Shot Pyrometer was 1623°F for Unit 1 and 1650°F for Unit 2. Therefore, the 1700°F Surveillance Requirement 3.6.9.3 acceptance criterion was not met during this event. Except as noted below, at no time during the previous three years while in Modes 1 or 2 (the modes for which HIS operability is required) was ignitor bus voltage low enough that the 1500°F required normal operation temperature (as cited in the above reference) could not be achieved. The only exception was the Loss of Offsite Power (LOOP) event that occurred on Units 1 and 2 on May 20, 2006, as documented in LER 413/2006-001. Following the LOOP, both units tripped and immediately entered Mode 3, where the HIS is no longer required to be operable. The diesel generators started and loaded properly and functioned as designed in response to the LOOP.
Hence, adequate bus voltage would have been available following the LOOP, had the HIS been required. Therefore, at all required times during the previous three years, the technically inoperable ignitors could have performed their required mitigation function and there was no Safety System Functional Failure.
The improperly sized fuses associated with HIS Train 1B could have potentially resulted in the premature loss of 6 ignitors in this train following an event where the HIS was required. A review of plant records for the previous three years revealed that there were 13 instances where HIS Train lA was logged inoperable. Twelve of these instances were associated with inspection of the train and were of approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> duration. During these 12 instances, HIS Train lA would still have been capable of performing its required function, had it been needed. The remaining instance occurred from 7/24/06 at 0400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br /> to 7/25/06 at 0448 hours0.00519 days <br />0.124 hours <br />7.407407e-4 weeks <br />1.70464e-4 months <br /> and was associated with train inspection and breaker replacement. Therefore, during the previous three years, there was only one instance of approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> duration where both Unit 1 HIS trains could potentially have been functionally impacted, which represented an extremely small overall plant risk. The 6 ignitors affected by the improperly sized fuse are located in lower containment. Any hydrogen that is produced following a degraded core accident would be released into lower containment.
There are 46 ignitors installed in lower containment locations. The remaining functional lower containment ignitors provide effective coverage in lower containment. Ignitors in the upper regions of containment provide additional coverage in the unlikely event that ignition is not initiated in the lower compartment. Therefore, even with 6 ignitors impacted by the improperly sized fuse, the overall functional capability of HIS Train 1B would have been maintained and there was no Safety System Functional Failure.
The health and safety of the public were not adversely affected by this event.
ADDITIONAL INFORMATION
Within the previous three years, there were no LER events involving the HIS. In addition, there were no LER events resulting from lack of monitoring and oversight of worker practices. There was one LER event, 413/2004-004, where a spurious moisture separator reheater high level actuation resulted in an automatic turbine trip and reactor trip. This event was believed to have resulted from inadequate procedural guidance. However, the corrective actions from this event would not have prevented the HIS event from occurring. In addition, there were no LER events resulting from design configuration issues. Therefore, this event was determined to be non-recurring in nature.
Energy Industry Identification System (EIIS) codes are identified in the text as [EIIS: XX]. This event is not considered reportable to the Equipment Performance and Information Exchange (EPIX) program.
This event is not considered to be a Safety System Functional Failure. There were no releases of radioactive materials, radiation overexposures, or personnel injuries associated with the events described in this LER.