View source for 05000286/LER-2015-001, Safety System Functional Failure Due to Inoperable Refueling Water Storage Tank Level Alarms Due to Freezing of the Level Instrument Sensing Lines Caused by a Failed Strip Heater

{{LER
| Title = Safety System Functional Failure Due to Inoperable Refueling Water Storage Tank Level Alarms Due to Freezing of the Level Instrument Sensing Lines Caused by a Failed Strip Heater
| Plant = Indian Point 3
| Reporting criterion = 10 CFR 50.73(a)(2)(v)(D), 10 CFR 50.73(a)(2)(vii)
| Power level = 100
| Mode = 1
| Docket = 05000286
| LER year = 2015
| LER number = 1
| LER revision = 0
| Event date = 1-8-2015
| Report date = 3-3-2015
}} On January 8, 2015, the Refueling Water Storage Tank ([[RWST|RWST]]) level sensing instrumentation lines (LT-920 and [[NRC LIC::LIC-921|LIC-921]]) were discovered frozen resulting in inoperable low-low level alarms in the Control Room. 	 Entered Technical Specification (TS) 	 3.5.4 	 ([[RWST|RWST]]) Condition C due to both [[RWST|RWST]] low-low level alarms disabled in the CR.

TS Condition C requires at least one channel of [[RWST|RWST]] low-low level to be restored to operable in one hour. Actions initiated to return one [[RWST|RWST]] level channel to operable..

Entered TS 3.5.4 Condition D (Required Action and associated Completion Time not met) D.1 be in. Mode 3 in 6 hours and D.2 be in Mode 4 in 12 hours. Commenced unit shutdown per TS for inoperable [[RWST|RWST]] level alarms. 	 Repairs and calibrations completed returning the [[RWST|RWST]] level alarms to operable. 	 TS 3.5.4 exited and power ascension commenced. Loss of-both LT alarms is a safety system functional failure as the alarms are credited for operator manual switchover for recirculation. 	 Direct cause was failure of the [[RWST|RWST]] instrument level alarm strip heater to maintain the temperature in the instrument enclosure. 	 - Due to the failure of the heat trace circuit EHT34-1 strip heater to . function combined with a period of severe cold weather resulted in the sensing lines for the [[RWST|RWST]].to freeze. 	 The apparent cause was a high resistance electrical connection at the strip heater wire lug due to thermal cycling and age. Corrective actions included _repair of ring lug to strip heater and calibration of level instrumentation.

Maintenance procedure 0-ELC-419-EHT will be revised to include inspection/repair of -. strip heater and ring lug connections within instrument enclosures. An action request (AR) will be initiated for a new model Work Order/PM to inspect strip heater connections and-operation. 	 The event had no significant effect on public health and safety.

Note: 	 The Energy Industry Identification System Codes are identified within the brackets {}.

== DESCRIPTION OF EVENT ==

On January 8, 2015, while at 100% steady state reactor power, Control Room (CR) Operators observed at 03:30 hours, that the Refueling Water Storage Tank ([[RWST|RWST]]) {BP} level on level sensing instrumentation (LT-920 and [[NRC LIC::LIC-921|LIC-921]] {LIC}) indicated high. Operations initiated inspections of the [[RWST|RWST]] level sensing lines. Heating level sensing lines were frozen resulting in inoperable [[RWST|RWST]] level alarms in the CR. At 04:00 hours, entered Technical Specification (TS) 3.5.4 ([[RWST|RWST]]) Condition C ([[RWST|RWST]] inoperable for reasons other than Condition A or B) due to both [[RWST|RWST]] low-low level alarms disabled in the CR. TS Condition C requires at least one channel of [[RWST|RWST]] low-low level to be restored to operable in one hour. Actions initiated to return one [[RWST|RWST]] level channel to operable. At 05:00 hours, entered TS 3.5.4 Condition D (Required Action and associated Completion Time not met) D.1 be in Mode 3 in 6 - hours and D.2 be- in Mode 4 in 12 hours. At 07:00 hours, commenced unit shutdown per TS for both [[RWST|RWST]] low low level alarms inoperable due to frozen sensing [[RWST|RWST]] local level indication per LI-921 {LI} is 36 feet and stable. Temperature at the indicator is 55 degrees F. At 10:00 hours, performed repairs to [[NRC LIC::LIC-921|LIC-921]] and LC-923. [[RWST|RWST]] level instrument check and calibrations ([[NRC LIC::LIC-921|LIC-921]] and LC-923) were completed satisfactorily returning minimum [[RWST|RWST]] level instrumentation ([[NRC LIC::LIC-921|LIC-921]] and LC-923) to operable. At 10:00 hours unit shutdown halted and power levels stabilized. At 10:09 hours a 4-hour and 8-hour event notification ([[Emergency notification::ENS 50722|EN#50722]]) was made to the NRC.-.Operations Center_for initiation of a_unit_shutdown_required by the_ TS and a safety system functional failure, for two channels of [[RWST|RWST]] level inoperable. At 11:15 hours, [[RWST|RWST]] level instrument check and calibration for loop 920A/B completed satisfactorily. returning LT-920 to operable. At approximately 11:15 hours exited TS 3.5.4. At 12-:55 hout-s-1 commenced power- ascension with full- power achieved at 19:36 hours. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program ([[CAP|CAP]]) as Condition Report CR-IP3- 2015-00084. 	  

* The [[RWST|RWST]] supplies borated water to the Chemical and Volume Control System ([[CVCS|CVCS]]) {CB} during abnormal operating conditions, to the refueling cavity during refueling, to the Emergency Core Cooling System ([[ECCS|ECCS]]) {BP} to fill accumulators, and to the [[ECCS|ECCS]] and the Containment Spray System ([[CSS|CSS]]) {BE} during accident conditions. During normal operation in Modes 1,2 and 3, the high head safety injection (HHSI) and residual heat removal ([[RHR|RHR]]) pumps are aligned to take suction from the [[RWST|RWST]]. During a loss of coolant accident ([[LOCA|LOCA]]), the [[RWST|RWST]] provides a source of borated water to the [[ECCS|ECCS]] and [[CSS|CSS]] pumps through separate headers during the injection phase. Following a [[LOCA|LOCA]], switchover from the injection phase to the recirculation phase must occur before the [[RWST|RWST]] empties to prevent damage to the pumps and a loss of cooling capability. For similar reasons, switchover must not pump suction. Furthermore, early switchover must not occur to ensure that sufficient borated water is injected from the [[RWST|RWST]]. The [[ECCS|ECCS]] design does not include automatic switchover from the safety injection mode to the recirculation mode based on low level in the [[RWST|RWST]] coincident with a safety injection signal.

This function is performed manually by an operator who must be alerted by redundant [[RWST|RWST]] low level alarms. The [[RWST|RWST]] level transmitters will cause the low level alarms to annunciate to ensure the CR operator is alerted to start the switchover to the recirculation mode during accident conditions. With both level alarms inoperable, neither the [[ECCS|ECCS]] nor the [[CSS|CSS]] can perform their design function.

== Corrective Actions ==

The following corrective actions have been or will be performed under the Corrective Action Program ([[CAP|CAP]]) to address the causes of this event.

* Repaired the ring lug to strip heater and calibration of level instrumentation ([[NRC LIC::LT-920]] and [[NRC LIC::LIC-921|LIC-921]]).

* Maintenance procedure 0-ELC-419-EHT will be revised to include inspection/repair of strip heater and ring lug connections within instrument enclosures.

* An action request (AR) will be initiated for a new model Work Order/PM to inspect strip heater connections and operation.

* Create tasks under existing [[Work order::WO 00401701#|Work Order 00401701]] to inspect for heat damage and connection integrity, and repair as necessary, the strip heaters and ring lug connections on the following components: 1) EHT34-1 STRP H, 2) EHT34-4 STRIP H, 3) EHT34-6./2 [[procedure::ST|ST]] HT, 4) EHT32-7 STRIP H, 5) LC6 STRIP HTR, 6) YK3 STRIP HTR.

* An evaluation will be performed of the best method for detecting strip heater failure and actions implemented under Engineering Change. Request ECR-.18431.

== Event Analysis ==

The event is reportable under [[CFR::10 CFR 50.73#a2vD|10CFR50.73(a)(2)(v)(D)]] as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that Are needed (D) mitigate the consequences of an accident (safety system functional failure) and under [[CFR::10 CFR 50.73#a2vii|10CFR50.73(a)(2)(vii)]] for any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to (D) mitigate the consequences of an accident. Loss of both [[RWST|RWST]] level alarm channels would prevent the credited alarm capability from alerting operators to initiate switchover to the recirculation mode during accident conditions on [[RWST|RWST]] low low level. With both level alarms inoperable, neither the [[ECCS|ECCS]] not the [[CSS|CSS]] can perform their design function of accident mitigation. This condition also meets the reporting criteria for a common cause inoperability of independent trains or channels as the two credited [[RWST|RWST]] level alarm channels were inoperable due to frozen sensing lines.

Event is not reportable under [[CFR::10 CFR 50.73#b2i|10CFR50.73(b)(2)(i)]] for the completion of a plant shutdown required by the TS as the shutdown was halted in Mode 1 at 43.3% reactor power.

Past Similar. Events A review was performed of the past three years of Licensee Event Reports ([[LER|LER]]s) for events that involved TS required shutdowns or [[SSFF|SSFF]]s due to loss of redundant instrumentation. There have been no [[LER|LER]]s in the last three years reporting conditions that required plant shutdown in accordance with the TS.

A review for [[LER|LER]]s reporting [[SSFF|SSFF]]s identified [[LER::05000286/LER-2012-001|LER-2012-001]] which reported a common cause inoperability of both trains of Auxiliary Feedwater ([[AFW|AFW]]) Pumps on October nitrogen backup to pneumatic actuators. The condition could have resulted in pump trip due to high flow from fail open on loss of instrument air without local operator action.

The apparent cause of not recognizing the need to station an operator locally to operate the [[AFW|AFW]] regulating valves prior to isolating the nitrogen supply was inadequate procedural guidance and licensing basis documents. The cause of the condition reported in [[LER::05000286/LER-2012-001|LER-2012-001]] was not a result of aging instrumentation. The only similar aspect of this event to [[LER::05000286/LER-2015-001|LER-2015-001]] was adequacy of procedures since there was no PM for strip heaters on TS systems ([[RWST|RWST]], PWST, CST, MT). However, corrective actions for [[LER::05000286/LER-2012-001|LER-2012-001]] would not have prevented this event.

== Safety Significance ==

This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or [[Transient|transient]]s during the time of the event.

Operators would be aware of [[RWST|RWST]] drain down as a result of an SI actuation.

A risk assessment was performed using the zero maintenance probabilistic risk assessment ([[PRA|PRA]]) model to determine the plant's baseline risk and the estimated increase in Core Damage Probability and Large Early Release Probability due to the unavailability of [[RWST|RWST]] level indication. For the approximately 8 hours period that the [[RWST|RWST]] level transmitters were out of service, the increase in Core Damage Probability ([[ICDP|ICDP]]) was estimated as 1.39E-7, while the increase in Large Early Release Probability ([[ILERP|ILERP]]) was estimated as 1.59E-9. Both the [[ICDP|ICDP]] and [[ILERP|ILERP]] values are below the risk significance values of [[SSC::1E-6|1E-6]] and [[SSC::1E-7|1E-7]], respectively. It can therefore be concluded that the risk of the - inoperable [[RWST|RWST]] level capability for the 8 hour out of service time had low safety significance.

{{LER-Nav}}