05000247/LER-2009-003

LER-2009-003, Loss of Single Train 21 Pressurizer Backup Heater Required for Remote Shutdown From the Control Room Due to an Inoperable Breaker

Indian Point 2
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v), Loss of Safety Function
2472009003R00 - NRC Website

Note: The Energy Industry Identification System Codes are identified within the brackets (}.

DESCRIPTION OF EVENT

On May 28, 2009, while at 100% steady state reactor power, at approximately 9:24 hours, control room (CR) alarm (Pressurizer Low Level 18% and 5%) [TB} came in and cleared, and (Pressurizer Heater Group Tripped) alarmed [TB} due to the trip of Pressurizer Heater Group 21 [AB} and Modulating Heater Group [AB} after completion of quarterly surveillance 2-PT-Q54 (Pressurizer Level Bistable Test), and return of the Pressurizer Level Defeat switch (L-460A) (HS) to its original position. At 9:28 hours, Operators attempted to restore pressurizer B/U heater group 21 but were unable to re-energize the 21 pressurizer backup (B/U) heater from the control room. CR Operators were able to reset and energize the 22 pressurizer B/U heaters and place the Modulating Heater Group in service. At approximately 9:30 hours, Technical Specification (TS) 3.3.4.A (Remote Shutdown) was entered for an inoperable 21 pressurizer backup (B/U) heater. TS 3.3.4 (Remote Shutdown Instrumentation) Limiting Condition for Operation (LCO), Remote Shutdown Function is required to be operable in Modes 1, 2 and 3. TS 3.3.4 Condition A, One or more functions inoperable, Required Action A, requires the functions to be restored to operable status within 30 days.

TS 3.3.4 Basis (Remote Shutdown) Table B 3.3.4-1 function 2.a, requires an operable 21 pressurizer B/U heater local/remote transfer switch for reactor coolant system (RCS) pressure control. Troubleshooting was performed on the 21 pressurizer B/U heater breaker (52/PBU1) (BKR}, and the breaker closed after its anti pump lever was realigned and testing was satisfactorily completed. On May 28, 2009, at approximately 11:00 hours, the 21 pressurizer B/U heater was declared operable and TS 3.3.4 Condition A exited. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as CR-IP2-2009-01965.

The Control Room (CR) is designed for an unlikely event that the CR becomes inaccessible and operators are required to establish control and shutdown the plant remote from the CR. This event is not an analyzed event in UFSAR Chapter 14 (Accident Analysis). The remote shutdown function provides designated equipment at appropriate locations outside the CR with the capability to shut down and maintain the unit in a safe condition in Mode 3. The remote shutdown TS LCO provides the operability requirements of the instrumentation and controls necessary to place and maintain the unit in Mode 3 from a location other than the CR. The instrumentation and controls are identified in TS Basis Table B 3.3.4-1 to include the single train 21 pressurizer B/U heater local/remote transfer switch. Although the instrumentation and control was functioning, the function of RCS pressure control was inoperable with the breaker for the 21 pressurizer B/U heater unable to close. The pressurizer level defeat switch (L/460A) is a manual mechanical selector switch [HS} manufactured by Foxboro (F180}. The 21 pressurizer B/U heater breaker (52/PBU1) is a 480 Volt AC (ED} breaker Model DB-50 manufactured by Westinghouse (W121}. The breaker anti pump lever is part of the breaker control relay assembly (RLY}. The control relay assembly is a 125 volt DC component manufactured by Westinghouse (121}.

Cause of Event

The apparent cause of the pressurizer heaters tripping was attributed to a degraded Pressureizer Level Defeat switch (L-460A) where a dead spot caused an intermittent interruption of continuity when the switch was rotated to the Defeat 3 position. The interruption would disrupt the input to pressurizer level bistables [2LC-459C/D (pressurizer level alarm with heaters off), and 2LC-459E/F (pressurizer level alarm with heaters on)] and momentarily simulate a downscale pressurizer level and thereby actuate the bistables causing the alarm and trip of the operating pressurizer heaters.

Corrective Actions

The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:

• Performed troubleshooting on the 21 pressurizer backup (B/U) heater breaker 52/PBU1, and repair of the breaker control relay trip (anti-pump) lever; Post Maintenance Testing included cycling the breaker open/closed.

• Pressurizer Level Defeat Switch L-460A and the control relay for breaker 52/PBU1 will be replaced and the breaker cubicle rail repaired. Scheduling of these activities in the 12 week Work Control process will be completed by August 5, 2009.

Event Analysis

The event is reportable under 10CFR50.73(a)(2)(v), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (A) shut down the reactor and maintain it in a safe shutdown condition." On May 28, 2009, at approximately at 9:28 hours, operations entered TS 3.3.4 Condition A for an inoperable 21 pressurizer B/U heater. The inoperability of the breaker for the 21 pressurizer backup heater was recognized as preventing the Technical Specification 3.3.4 (Remote Shutdown) function (TS Basis Table 3.3.4-1, Function 2.a, 21 Pressurizer Backup Heater Local/Remote Transfer Switch) for reactor coolant system pressure control. However, operations did not recognize the condition was a safety system functional failure and failed to make the 8-hour non-emergency notification under 10CFR50.72(b)(3)(v)to the NRC. The failure to make an 8-hour notification was recorded in the CAP as CR-IP2-2009-02072. TS 3.3.4 Basis (Remote Shutdown) Table B3.3.4-1 function 2.a requires an operable 21 pressurizer B/U heater local/remote transfer switch for reactor coolant system pressure control. The inoperable single train 21 pressurizer B/U heater resulted in a safety system functional failure.

NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (9-2007) FACILITY NAME (1) DOCKET (2) ( i�LER NUMBER 6j PAGE (3) Past Similar Events.

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved inoperable remote shutdown functions. No unit 2 LERs were identified. However, unit 3 reported in LER-2008-002 a similar loss of their single train 31 pressurizer heater. The unit 3 event was a different cause as that event was due to a failed pressurizer heater transformer.

Safety Significance

This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients requiring shutdown outside the CR. Shutdown outside the CR could also be accomplished with one of the remaining pressurizer heaters through use of local breaker operation or without the use of the heaters. Operation of the 21 pressurizer B/U heater breaker from the remote shutdown switch would have operated prior to the surveillance testing as the test switch (L-460A) is not part of the actuating circuit. The protective function of the circuit would have operated properly. The condition resulted during surveillance testing of pressurizer level bistables. In accordance with NUREG-0800, Section 7.4, shutdown remote from the CR is not an event analyzed in the USFAR for accident analysis (Chapter 14). Specific scenarios are not specified on which the adequacy of shutdown capability remote from the CR is evaluated. A recognized type of event that could force the evacuation of the CR and the need to shut down remote from the CR is smoke from a fire. Fire damage limits as they impact safe shutdown do not require consideration of an additional random single failure in the capability to safely shut down. Therefore, application of single failure to remote shutdown is applicable only to other events that could cause the CR to become uninhabitable.

These events would not result in consequential damage or unavailability of systems required for safe shutdown.