05000286/LER-2015-001
Indian Point 3 | |
Event date: | 1-8-2015 |
---|---|
Report date: | 3-3-2015 |
Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability |
Initial Reporting | |
ENS 50722 | 10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident, 10 CFR 50.72(b)(2)(i), Tech Spec Required Shutdown |
2862015001R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On January 8, 2015, while at 100% steady state reactor power, Control Room (CR) Operators observed at 03:30 hours, that the Refueling Water Storage Tank (RWST) {BP} level on level sensing instrumentation (LT-920 and LIC-921 {LIC}) indicated high. Operations initiated inspections of the RWST level sensing lines. Heating inside the level control box was suspect. Field inspection revealed that both level sensing lines were frozen resulting in inoperable RWST level alarms in the CR. At 04:00 hours, entered Technical Specification (TS) 3.5.4 (RWST) Condition C (RWST inoperable for reasons other than Condition A or B) due to both RWST low-low level alarms disabled in the CR. TS Condition C requires at least one channel of RWST low-low level to be restored to operable in one hour. Actions initiated to return one RWST level channel to operable. At 05:00 hours, entered TS 3.5.4 Condition D (Required Action and associated Completion Time not met) D.1 be in Mode 3 in 6 - hours and D.2 be- in Mode 4 in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. At 07:00 hours, commenced unit shutdown per TS for both RWST low low level alarms inoperable due to frozen sensing lines. Placed control rods {AA} in manual and commenced boration. At 08:11 hours, RWST local level indication per LI-921 {LI} is 36 feet and stable. Temperature at the indicator is 55 degrees F. At 10:00 hours, performed repairs to LIC-921 and LC-923. RWST level instrument check and calibrations (LIC-921 and LC-923) were completed satisfactorily returning minimum RWST level instrumentation (LIC-921 and LC-923) to operable. At 10:00 hours unit shutdown halted and power levels stabilized. At 10:09 hours a 4-hour and 8-hour event notification (EN#50722) was made to the NRC.-.Operations Center_for initiation of a_unit_shutdown_required by the_ TS and a safety system functional failure, for two channels of RWST level inoperable. At 11:15 hours, RWST level instrument check and calibration for loop 920A/B completed satisfactorily. returning LT-920 to operable. At approximately 11:15 hours exited TS 3.5.4. At 12-:55 hout-s-1 commenced power- ascension with full- power achieved at 19:36 hours. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as Condition Report CR-IP3- 2015-00084.
- . .
- The RWST supplies borated water to the Chemical and Volume Control System (CVCS) {CB} during abnormal operating conditions, to the refueling cavity during refueling, to the Emergency Core Cooling System (ECCS) {BP} to fill accumulators, and to the ECCS and the Containment Spray System (CSS) {BE} during accident conditions. During normal operation in Modes 1,2 and 3, the high head safety injection (HHSI) and residual heat removal (RHR) pumps are aligned to take suction from the RWST. During a loss of coolant accident (LOCA), the RWST provides a source of borated water to the ECCS and CSS pumps through separate headers during the injection phase. Following a LOCA, switchover from the injection phase to the recirculation phase must occur before the RWST empties to prevent damage to the pumps and a loss of cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment to support recirculation pump suction. Furthermore, early switchover must not occur to ensure that sufficient borated water is injected from the RWST. The ECCS design does not include automatic switchover from the safety injection mode to the recirculation mode based on low level in the RWST coincident with a safety injection signal.
This function is performed manually by an operator who must be alerted by redundant RWST low level alarms. The RWST level transmitters will cause the low level alarms to annunciate to ensure the CR operator is alerted to start the switchover to the recirculation mode during accident conditions. With both level alarms inoperable, neither the ECCS nor the CSS can perform their design function.
Corrective Actions
The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event.
- Repaired the ring lug to strip heater and calibration of level instrumentation (LT-920 and LIC-921).
- Maintenance procedure 0-ELC-419-EHT will be revised to include inspection/repair of strip heater and ring lug connections within instrument enclosures.
- An action request (AR) will be initiated for a new model Work Order/PM to inspect strip heater connections and operation.
- Create tasks under existing Work Order 00401701 to inspect for heat damage and connection integrity, and repair as necessary, the strip heaters and ring lug connections on the following components: 1) EHT34-1 STRP H, 2) EHT34-4 STRIP H, 3) EHT34-6./2 ST HT, 4) EHT32-7 STRIP H, 5) LC6 STRIP HTR, 6) YK3 STRIP HTR.
- An evaluation will be performed of the best method for detecting strip heater failure and actions implemented under Engineering Change. Request ECR-.18431.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(v)(D) as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that Are needed (D) mitigate the consequences of an accident (safety system functional failure) and under 10CFR50.73(a)(2)(vii) for any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to (D) mitigate the consequences of an accident. Loss of both RWST level alarm channels would prevent the credited alarm capability from alerting operators to initiate switchover to the recirculation mode during accident conditions on RWST low low level. With both level alarms inoperable, neither the ECCS not the CSS can perform their design function of accident mitigation. This condition also meets the reporting criteria for a common cause inoperability of independent trains or channels as the two credited RWST level alarm channels were inoperable due to frozen sensing lines.
Event is not reportable under 10CFR50.73(b)(2)(i) for the completion of a plant shutdown required by the TS as the shutdown was halted in Mode 1 at 43.3% reactor power.
Past Similar. Events A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved TS required shutdowns or SSFFs due to loss of redundant instrumentation. There have been no LERs in the last three years reporting conditions that required plant shutdown in accordance with the TS.
A review for LERs reporting SSFFs identified LER-2012-001 which reported a common cause inoperability of both trains of Auxiliary Feedwater (AFW) Pumps on October 11,.2011, due to the inability to control AFW regulating valves after isolation of nitrogen backup to pneumatic actuators. The condition could have resulted in pump trip due to high flow from fail open on loss of instrument air without local operator action.
The apparent cause of not recognizing the need to station an operator locally to operate the AFW regulating valves prior to isolating the nitrogen supply was inadequate procedural guidance and licensing basis documents. The cause of the condition reported in LER-2012-001 was not a result of aging instrumentation. The only similar aspect of this event to LER-2015-001 was adequacy of procedures since there was no PM for strip heaters on TS systems (RWST, PWST, CST, MT). However, corrective actions for LER-2012-001 would not have prevented this event.
Safety Significance
This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients during the time of the event.
Operators would be aware of RWST drain down as a result of an SI actuation.
Adequate water inventory in the containment to- provide adequate ECCS pump suction -can be confirmed by recirculation and/or containment 'sump level indication.
A risk assessment was performed using the zero maintenance probabilistic risk assessment (PRA) model to determine the plant's baseline risk and the estimated increase in Core Damage Probability and Large Early Release Probability due to the unavailability of RWST level indication. For the approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period that the RWST level transmitters were out of service, the increase in Core Damage Probability (ICDP) was estimated as 1.39E-7, while the increase in Large Early Release Probability (ILERP) was estimated as 1.59E-9. Both the ICDP and ILERP values are below the risk significance values of 1E-6 and 1E-7, respectively. It can therefore be concluded that the risk of the - inoperable RWST level capability for the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> out of service time had low safety significance.