05000286/LER-2009-009
| Indian Point 3 | |
| Event date: | 10-14-2009 |
|---|---|
| Report date: | 11-3-2010 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| Initial Reporting | |
| ENS 45432 | 10 CFR 50.72(b)(3)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 2862009009R01 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets U.
DESCRIPTION OF EVENT
On October 14, 2009, while at 100% steady state reactor power, at approximately 15:00 hours, the power supply {JX} for neutron flux detector {DET} (source range) N-38 {IG} was determined to be unable to provide reliable power to the detector. The detector was declared inoperable and Technical Specification (TS) 3.3.4 (Remote Shutdown) Condition A was entered. The neutron flux detector (source range) N-38 is a function specified in TS Basis Table 3.3.4-1 Function 1, Reactivity Control, and credited in TS 3.3.3 (Post Accident Monitoring Instrumentation), and in Technical Requirements Manual (TRM) 3.3.D, Appendix R Alternate Safe Shutdown Monitoring. The inoperable N-38 results in a failure to meet the specified safety function of TS 3.3.4 and meets the reporting criteria of 10CFR50.72(b)(3)(v) for a condition that could have prevented the fulfillment of a safety function needed to shut down the reactor and maintain it in a safe shutdown condition. At 17:09 hours, an 8-hour non-emergency notification was made to the NRC for a safety system functional failure (EN #45432). The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as CR-IP3-2009-04123. Subsequently, engineering determined past operability was not properly assessed on N-38 when the power range channel was declared inoperable on September 24, 2009. This condition was recorded as CR-IP3-2010-01433.
On July 18, 2009, during performance of 3-PT-M100 (Monthly Post Accident Monitor Cannel Checks), it was discovered that channel N-38 did not indicate within 10% of reactor power. Neutron flux detector channel N-38 was indicating approximately 81%, while channel N-39 was indicating approximately 92% with actual reactor power at approximately 100%. Work Orders (WO) were issued for a full power alignment (calibration) in the normal 12 week work control process with the alignment scheduled for September 24, 2009. This condition was recorded in the CAP as CR-IP3-2009-03108.
Channel N-38 continued to indicate between 81-83% reactor power as documented in WOs implementing testing performed on August 14, 2009 and September 11, 2009, with the signal from both channels remaining steady but lower than 100% reactor power. On September 24, 2009, during performance of IC-SI-18 (Full Power Alignment for the Gamma- Metrics Excore Nuclear Instrumentation System), channel N-38 could not be aligned and drifted up to 151% of reactor power. Operations declared the power range portion of N 38 inoperable and entered TS 3.3.3. This condition was recorded as CR-IP3-2009-03904.
The data from the source and intermediate ranges were judged satisfactory at the time and met the requirements of TS 3.3.4 and TRO 3.3.D based on successful completion of 3 PT-M099 (Safe Shutdown Instrument Channel Checks and Miscellaneous Equipment Surveillance). Engineering and Maintenance believed at the time that there were separate low voltage power supplies for the source and wide range circuitry. On October 14, 2009, N-38 source range started reading on-scale and the N-38 source range function was declared inoperable and TS 3.3.4 and TRM 3.3.D was entered.
A safety related excore Nuclear Instrumentation System (NIS) {IG} is provided that measures neutron leakage from the core and is composed of neutron flux detectors (power, intermediate and source range) external to the reactor vessel. The excore NIS provides input to the reactor protection system {JC} by monitoring neutron flux and generating appropriate trips and alarms for various phases of reactor operating and shutdown conditions. The NIS also provides inputs to other protection circuits for additional reactor trips that limit the operation of the reactor to the range allowed by the TS, and provides input to the rod control system, various interlocks and rod stop features. Additionally, there are two full range excore detectors that were added to the plant design. Neutron flux detectors N-38 and N-39 are Gamma-Metrics {G077} Wide Range excore fission chamber type neutron flux detectors {IG}. The detectors are designed to monitor for possible power excursions during harsh containment conditions following a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB).
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(v), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (A) shut down the reactor and maintain it in a safe shutdown condition." On October 14, 2009, at approximately 15:00 hours, operations entered TS 3.3.4.A for an inoperable neutron flux detector (source range) N-38. The inoperability of N-38 (source range) was recognized as preventing the Technical Specification 3.3.4 (Remote Shutdown) function (TS Basis Table 3.3.4-1, Function 1.a, Source Range Neutron Flux for Reactivity Control). The inoperable single train N-38 resulted in a safety system functional failure. The operable power supply from redundant neutron flux detector N 39, which is not credited in TS 3.3.4 was used as a replacement to return N-38 to operable status.
Neutron flux detector N-38 was returned to service and the TS 3.3.4 action statement exited on October 15, 2009 at 14:00 hours. TS 3.3.3 Condition A was entered for neutron flux detector N-39 at 10:15 hours on October 15, 2009. The TS 3.3.3 entry was back dated to 18:00 hours on September 24, 2009 in accordance with the guidelines of TS 1.3 (Completion Times). After installing a new power supply for N-39 and calibrating it, TS 3.3.3 action statement was exited for N-39 on November 10, 2009, at 21:25 hours.
In accordance with the reporting guidelines of NUREG-1022, Section 3.2.7, removal of a system or part of a system from service as part of a planned evolution for maintenance or surveillance testing when done in accordance with approved procedures and TS is not reportable. Therefore, the removal of N-39 from service during the time N-38 was inoperable was not considered a SSFF.
Further assessment of the past operability of the N-38 determined that the N-38 signal started to degrade on September 15, 2009, at approximately 14:48 hours and trended down until September 24, 2009, when full power alignment testing showed significant drift and the power range channel was declared inoperable. The N-38 circuitry was offset high during the full power alignment to compensate for the degraded power supply. The power supply voltage continued to degrade and the N-38 signal continued to decline until it was reading on-scale for source range indication on October 14, 2009, at which time the N-38 source range channel was declared inoperable. The time of inoperability of N-38 (September 15, 2009 at 14:48 hours until October 15 at 14:00 hours), is less than the TS 3.3.4 and TS 3.3.3 AOT of 30 days therefore, the inoperable condition was not a TS prohibited condition.
Past Similar Events
A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved inoperable remote shutdown functions. LER-2008-002 reported on April 18, 2008, a safety system functional failure due to the loss of single train 31 pressurizer heater as a result of a failed power supply transformer. The 31 pressurizer heater was credited in TS 3.3.4 for plant shutdown remote from the CR.
The unit 3 event was a different cause as that event was due to transformer insulation breakdown.
Cause of Event
The apparent cause of a failed power supply was a lack of a recurring preventive maintenance (PM) action to replace the low voltage power supply because N-38 was not included in the Indian Point Energy Center (IPEC) Power Supply PM Program or the IPEC Capacitor Replacement Program. PMs are created based on component classification that are input into the IPEC work control program (WM-101). Component classification is determined using EN-DC-153, "Preventive Maintenance Component Classification." N-38 was classified as low critical using engineering judgment and the screening guidance of Entergy procedure EN-DC-153. The initial N-38 classification was based on its TS AOT instead of its safety function. Industry operating experience has indicated that power supplies which utilize capacitors and components prone to age-related degradation have life spans of approximately 15-20 years. A review of work orders did not identify any evidence that the low voltage power supplies have been replaced within this timeframe.
Corrective Actions
The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:
- The N-38 power supply was replaced with the operable power supply from redundant neutron flux detector N-39 which is not credited in TS 3.3.4. A new power supply for N-39 was purchased and installed on November 10, 2009.
- A new PM was initiated to periodically replace the power supplies of N-38 and N-39.
- A new power supply for N-38 was purchased and installed on May 6, 2010.
- N-38 was reclassified as high critical.
- Procedure 3-PT-M100 (Monthly Post Accident Monitor Cannel Checks) will be enhanced to incorporate revisions to move the "Note" regarding N-38/N-39 full power alignment from the "Test Acceptance" section to "Testing" under the Neutron Flux section, and as part of the Note, the current reactor power level should be recorded. The term decade will be included in the Definitions section.
Safety Significance
This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients requiring shutdown outside the CR. Detector N-38 provides no actuation function only indication. The NIS neutron flux detectors provide the high flux level reactor trip and alarms signals to the reactor control and protection systems. The inoperability of N-38 used for monitoring the condition of the reactor from outside the control room could be compensated for by operators via verification of control rod position (maintenance of shutdown margin) and reactor temperature and pressure (negative temperature/pressure reactivity coefficients) until the operability of N-38 could be restored. In addition, as discussed in UFSAR Section 7.7.3 (Emergency Shutdown Control), with the reactor in hot shutdown conditions, boration is not required immediately after shutdown. The core Xenon transient does not decay to equilibrium level until at least nine hours after shutdown and a further period would elapse before the reactivity margin provided by the full-length control rods had been canceled. This delay would provide time for implementing emergency measures.
In accordance with NUREG-0800, Section 7.4 (Safe Shutdown Systems), shutdown remote from the CR is not an event analyzed in the USFAR for accident analysis (Chapter 14).
Specific scenarios are not specified on which the adequacy of shutdown capability remote from the CR is evaluated. A recognized type of event that could force the evacuation of the CR and the need to shut down remote from the CR is smoke from a fire.
Fire damage limits as they impact safe shutdown do not require consideration of an additional random single failure in the capability to safely shut down. Therefore, application of single failure to remote shutdown is applicable only to other events that could cause the CR to become uninhabitable. These events would not result in consequential damage or unavailability of systems required for safe shutdown.