05000286/LER-2015-001, Safety System Functional Failure Due to Inoperable Refueling Water Storage Tank Level Alarms Due to Freezing of the Level Instrument Sensing Lines Caused by a Failed Strip Heater
| Indian Point 3 | |
| Event date: | 1-8-2015 |
|---|---|
| Report date: | 3-3-2015 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability |
| 2862015001R00 - NRC Website | |
On January 8, 2015, the Refueling Water Storage Tank (RWST) level sensing instrumentation lines (LT-920 and LIC-921) were discovered frozen resulting in inoperable low-low level alarms in the Control Room. Entered Technical Specification (TS) 3.5.4 (RWST) Condition C due to both RWST low-low level alarms disabled in the CR.
TS Condition C requires at least one channel of RWST low-low level to be restored to operable in one hour. Actions initiated to return one RWST level channel to operable..
Entered TS 3.5.4 Condition D (Required Action and associated Completion Time not met) D.1 be in. Mode 3 in 6 hours and D.2 be in Mode 4 in 12 hours. Commenced unit shutdown per TS for inoperable RWST level alarms. Repairs and calibrations completed returning the RWST level alarms to operable. TS 3.5.4 exited and power ascension commenced. Loss of-both LT alarms is a safety system functional failure as the alarms are credited for operator manual switchover for recirculation. Direct cause was failure of the RWST instrument level alarm strip heater to maintain the temperature in the instrument enclosure. - Due to the failure of the heat trace circuit EHT34-1 strip heater to . function combined with a period of severe cold weather resulted in the sensing lines for the RWST.to freeze. The apparent cause was a high resistance electrical connection at the strip heater wire lug due to thermal cycling and age. Corrective actions included _repair of ring lug to strip heater and calibration of level instrumentation.
Maintenance procedure 0-ELC-419-EHT will be revised to include inspection/repair of -. strip heater and ring lug connections within instrument enclosures. An action request (AR) will be initiated for a new model Work Order/PM to inspect strip heater connections and-operation. The event had no significant effect on public health and safety.
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On January 8, 2015, while at 100% steady state reactor power, Control Room (CR) Operators observed at 03:30 hours, that the Refueling Water Storage Tank (RWST) {BP} level on level sensing instrumentation (LT-920 and LIC-921 {LIC}) indicated high. Operations initiated inspections of the RWST level sensing lines. Heating level sensing lines were frozen resulting in inoperable RWST level alarms in the CR. At 04:00 hours, entered Technical Specification (TS) 3.5.4 (RWST) Condition C (RWST inoperable for reasons other than Condition A or B) due to both RWST low-low level alarms disabled in the CR. TS Condition C requires at least one channel of RWST low-low level to be restored to operable in one hour. Actions initiated to return one RWST level channel to operable. At 05:00 hours, entered TS 3.5.4 Condition D (Required Action and associated Completion Time not met) D.1 be in Mode 3 in 6 - hours and D.2 be- in Mode 4 in 12 hours. At 07:00 hours, commenced unit shutdown per TS for both RWST low low level alarms inoperable due to frozen sensing RWST local level indication per LI-921 {LI} is 36 feet and stable. Temperature at the indicator is 55 degrees F. At 10:00 hours, performed repairs to LIC-921 and LC-923. RWST level instrument check and calibrations (LIC-921 and LC-923) were completed satisfactorily returning minimum RWST level instrumentation (LIC-921 and LC-923) to operable. At 10:00 hours unit shutdown halted and power levels stabilized. At 10:09 hours a 4-hour and 8-hour event notification (EN#50722) was made to the NRC.-.Operations Center_for initiation of a_unit_shutdown_required by the_ TS and a safety system functional failure, for two channels of RWST level inoperable. At 11:15 hours, RWST level instrument check and calibration for loop 920A/B completed satisfactorily. returning LT-920 to operable. At approximately 11:15 hours exited TS 3.5.4. At 12-:55 hout-s-1 commenced power- ascension with full- power achieved at 19:36 hours. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as Condition Report CR-IP3- 2015-00084.
- The RWST supplies borated water to the Chemical and Volume Control System (CVCS) {CB} during abnormal operating conditions, to the refueling cavity during refueling, to the Emergency Core Cooling System (ECCS) {BP} to fill accumulators, and to the ECCS and the Containment Spray System (CSS) {BE} during accident conditions. During normal operation in Modes 1,2 and 3, the high head safety injection (HHSI) and residual heat removal (RHR) pumps are aligned to take suction from the RWST. During a loss of coolant accident (LOCA), the RWST provides a source of borated water to the ECCS and CSS pumps through separate headers during the injection phase. Following a LOCA, switchover from the injection phase to the recirculation phase must occur before the RWST empties to prevent damage to the pumps and a loss of cooling capability. For similar reasons, switchover must not pump suction. Furthermore, early switchover must not occur to ensure that sufficient borated water is injected from the RWST. The ECCS design does not include automatic switchover from the safety injection mode to the recirculation mode based on low level in the RWST coincident with a safety injection signal.
This function is performed manually by an operator who must be alerted by redundant RWST low level alarms. The RWST level transmitters will cause the low level alarms to annunciate to ensure the CR operator is alerted to start the switchover to the recirculation mode during accident conditions. With both level alarms inoperable, neither the ECCS nor the CSS can perform their design function.
Corrective Actions
The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event.
- Repaired the ring lug to strip heater and calibration of level instrumentation (LT-920 and LIC-921).
- Maintenance procedure 0-ELC-419-EHT will be revised to include inspection/repair of strip heater and ring lug connections within instrument enclosures.
- An action request (AR) will be initiated for a new model Work Order/PM to inspect strip heater connections and operation.
- Create tasks under existing Work Order 00401701 to inspect for heat damage and connection integrity, and repair as necessary, the strip heaters and ring lug connections on the following components: 1) EHT34-1 STRP H, 2) EHT34-4 STRIP H, 3) EHT34-6./2 ST HT, 4) EHT32-7 STRIP H, 5) LC6 STRIP HTR, 6) YK3 STRIP HTR.
- An evaluation will be performed of the best method for detecting strip heater failure and actions implemented under Engineering Change. Request ECR-.18431.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(v)(D) as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that Are needed (D) mitigate the consequences of an accident (safety system functional failure) and under 10CFR50.73(a)(2)(vii) for any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to (D) mitigate the consequences of an accident. Loss of both RWST level alarm channels would prevent the credited alarm capability from alerting operators to initiate switchover to the recirculation mode during accident conditions on RWST low low level. With both level alarms inoperable, neither the ECCS not the CSS can perform their design function of accident mitigation. This condition also meets the reporting criteria for a common cause inoperability of independent trains or channels as the two credited RWST level alarm channels were inoperable due to frozen sensing lines.
Event is not reportable under 10CFR50.73(b)(2)(i) for the completion of a plant shutdown required by the TS as the shutdown was halted in Mode 1 at 43.3% reactor power.
Past Similar. Events A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved TS required shutdowns or SSFFs due to loss of redundant instrumentation. There have been no LERs in the last three years reporting conditions that required plant shutdown in accordance with the TS.
A review for LERs reporting SSFFs identified LER-2012-001 which reported a common cause inoperability of both trains of Auxiliary Feedwater (AFW) Pumps on October nitrogen backup to pneumatic actuators. The condition could have resulted in pump trip due to high flow from fail open on loss of instrument air without local operator action.
The apparent cause of not recognizing the need to station an operator locally to operate the AFW regulating valves prior to isolating the nitrogen supply was inadequate procedural guidance and licensing basis documents. The cause of the condition reported in LER-2012-001 was not a result of aging instrumentation. The only similar aspect of this event to LER-2015-001 was adequacy of procedures since there was no PM for strip heaters on TS systems (RWST, PWST, CST, MT). However, corrective actions for LER-2012-001 would not have prevented this event.
Safety Significance
This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients during the time of the event.
Operators would be aware of RWST drain down as a result of an SI actuation.
A risk assessment was performed using the zero maintenance probabilistic risk assessment (PRA) model to determine the plant's baseline risk and the estimated increase in Core Damage Probability and Large Early Release Probability due to the unavailability of RWST level indication. For the approximately 8 hours period that the RWST level transmitters were out of service, the increase in Core Damage Probability (ICDP) was estimated as 1.39E-7, while the increase in Large Early Release Probability (ILERP) was estimated as 1.59E-9. Both the ICDP and ILERP values are below the risk significance values of 1E-6 and 1E-7, respectively. It can therefore be concluded that the risk of the - inoperable RWST level capability for the 8 hour out of service time had low safety significance.