05000410/LER-2002-002

LER-2002-002,

Event date:	3-16-2002
Report date:	9-12-2002
Reporting criterion:	10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(vii)(C), Common Cause Inoperability 10 CFR 50.73(a)(2)(v), Loss of Safety Function
4102002002R00 - NRC Website

I. Description of Event

On March 16, 2002 at approximately 0030, Reactor Water Cleanup System (RWCU) Division I and Division II differential flow timers were declared inoperable because of unexpected response. The plant was shutting down for Refueling Outage 8 with thermal power approximately 18 percent. Flow from the RWCU was being directed to the condenser to control reactor vessel water level. As operators increased flow to the condenser, the differential flow indication also increased, which was unexpected. The purpose of the differential flow instrumentation is to identify breaks in the RWCU and automatically isolate RWCU from the Reactor Coolant System when the differential flow value reaches a predetermined setpoint and remains there for a specified period of time. Operations investigated the unexpected response and concluded that there was no leak or break in the RWCU system and that the differential flow instrumentation was malfunctioning. Operations then declared the differential flow instrumentation inoperable and entered the Action Statements for Technical Specification (TS) 3.3.6.1. The actions were to isolate the penetration within one hour, or be in hot shutdown within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and cold shutdown within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Operations continued with the plant shutdown. At 0156 the mode switch was placed in shutdown and the plant reached cold shutdown at approximately 0840 on March 16, 2002. The plant exited the TS action statement after reaching cold shutdown. Operations initially assessed the inoperability of the RWCU differential flow instrumentation as a condition that was not reportable.

Upon reviewing the Deviation / Event Report for the event, Licensing questioned the reportability determination.

Subsequent evaluations included a review of the Unit 2 Updated Final Safety Analysis Report (UFSAR), TS, and TS Bases. A consensus was reached that the differential flow isolation was redundant to the level 2 reactor water level isolation and area high temperature isolation of RWCU and therefore the inoperability of the differential flow instrumentation was not a loss of function. The decision was in part based on the UFSAR statement "diversity of trip initiation signals for a RWCU system line break is provided by instrumentation for reactor water level, differential flow, and ambient temperature in RWCU equipment areas." Further evaluation by Engineering and Licensing Departments concluded that although the differential flow isolation, low reactor water level isolation and high temperature isolation were diverse they were not redundant. Specifically, in the design of the RWCU system a "cold leg" break would be isolated by a differential flow signal and there was no analysis or calculation showing that either the high area temperature isolation or the low reactor vessel water level isolation are redundant to the differential flow isolation.

There is no supporting design analysis substantiating the redundancy, therefore the inoperability of the differential flow instrumentation was determined to be reportable per 10 CFR 50.73(a)(2)(v), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (C) Control the release of radioactive material," and per 10 CFR 50.73(a)(2)(vii), "Any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to: (C) Control the release of radioactive material.

II. Cause of Event

The cause of the unexpected differential flow indication was inadequate restoration of RWCU after maintenance.

Previously, the RWCU system had been removed from service and portions drained to allow modification to the isolation valves for the filter/demineralizers. After returning RWCU to service, some of the air migrated to the differential flow sensing lines and became trapped there, resulting in the instrument response observed by operators.

The determination of the reportability of the event was a knowledge based activity. The cause of the incorrect reportability determination is an incomplete understanding of the relationship among the RWCU isolation signals of low reactor water level, high ambient area temperature and differential flow. Personnel involved in determining that the event was not reportable incorrectly understood that the other system isolation capabilities were redundant to the differential flow isolation.

III. Analysis of Event

The event is reportable in accordance with 10 CFR 50.73(a)(2)(v) as "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (C) Control the release of radioactive material." This criterion applies because the differential flow isolation alone provides the function to isolate a break in the RWCU "cold leg". The event is also reportable in accordance with 10 CFR 50.73(a)(2)(vii) as "Any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to: (C) Control the release of radioactive material." This criterion applies because the air in RWCU after system restoration resulted in the inoperability of both Division I and Division II RWCU differential flow instrumentation.

The following considerations were used to assess the impact of inoperable RWCU differential flow instrumentation:

• Although, the RWCU isolation valves would not have automatically isolated on a high differential flow signal, the valves would still have closed as a result of low reactor vessel water level or high ambient area temperatures.

• A break would result in increasing sump levels, sump alarms, and RWCU system flow alarms which would alert operators to abnormal conditions, allowing them to take mitigating action. The RWCU "cold leg" supplies cooling flow to the RWCU regenerative heat exchanger which provides initial cooling of reactor coolant that is entering the RWCU system. A break in the "cold leg" of RWCU could result in decreased cooling flow to the RWCU regenerative heat exchanger. Reduced cooling flow to the regenerative heat exchanger would result in increased filter/demineralizer inlet temperatures that could lead to a high temperature alarm in the control room and automatic isolation of RWCU. The high filter/demineralizer inlet temperature isolation of RWCU is for the protection of the demineralizer.

• Technical Specifications require the differential flow isolation function to be operable in conditions above cold shutdown. From declaring the differential flow instrumentation inoperable until entering cold shut down was a period of approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. During this 8-hour period, the ability for operators to remotely close the isolation valves from the control room was maintained.

• A calculation to support Licensee Event Report (LER) 97-08 determined that a loss of inventory in the RWCU system occurring for 14 minutes would result in a dose below the 500 milliRem whole body or equivalent.

The calculation assumes that a break in RWCU results in a steam release. Since a "cold leg" break would not result in the liquid flashing to steam, the dose associated with a "cold leg" break would be considerably less.

• A qualitative risk assessment of the event concluded that the event was of low risk significance.

Based on the above, the inoperability of the RWCU differential flow instrumentation did not pose a threat to the health and safety of the public or plant personnel.

IV. Corrective Actions

1. Flow transmitter sensing lines were vented and differential flow indication returned to expected behavior.

2. Modified procedure N2-OP-37, REACTOR WATER CLEANUP SYSTEM, to vent instrumentation for all the flow transmitters during the restoration of the RWCU.

3. The generic issue of venting systems or instrumentation has been entered into the corrective action program as DER 2002-2323.

4. Procedure N2-OP-37, REACTOR WATER CLEANUP SYSTEM, will be modified to include reportability guidance for conditions in which both Division I and Division II of RWCU differential flow instrumentation are inoperable.

5. The specifics of this event and the lessons learned will be covered in Operations Training for Senior Reactor Operators.

V . Additional Information

A. Failed Components:

Component � Manufacturer � Model Number Flow transmitter 2WCS*FT69X � Rosemount � 1153DB4 Flow transmitter 2WCS*FT69Y � Rosemount � 1153DB4

B. Previous similar events:

of equipment, flow instrumentation, is similar the causes are different and corrective actions would not have prevented the inoperability of the RWCU differential flow instrumentation.

C. Identification of components referred to in this Licensee Event Report Components � IEEE 805 System ID � IEEE 803A Function Reactor Recirculation System � AD � N/A Reactor Water Cleanup System � CE � N/A Condenser System � SG � N/A Containment Isolation System � JM � N/A Nuclear Leak Detection System � IJ � N/A Reactor Vessel � AD � RPV Condenser � SG � COND Valve � CE, JM � ISV Transmitter � CE, IJ � FT, TT Filter Demineralizer � CE � FDM Heat Exchanger � CE � HX