05000247/LER-2006-001
| Docket Number | |
| Event date: | 3-1-2006 |
|---|---|
| Report date: | 4-18-2006 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 2472006001R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within brackets � }
DESCRIFTION OF EVENT
On March 1, 2006, at 1435 hours0.0166 days <br />0.399 hours <br />0.00237 weeks <br />5.460175e-4 months <br />, while at approximately 100% steady state reactor power, Control Room {NA} operators initiated a manual reactor trip (RT) (JC) as a result of indications that multiple control rods (CR) {AA} had dropped into the reactor core {AC}. All RT breakers {AA} opened but all rod bottom lights {IL} did not illuminate. CRs [Rod Cluster Control Assemblies (RCCA)] L7, J13, F6, F10, K10, C5, and C13 were not considered fully inserted because the rod bottom lights for these CRs did not illuminate. The Plant Information Computer System (PICS) {10} indicated all CRs were fully inserted.
In acccrdance with plant procedures, operators re-initiated a manual RT.
Operations verified the reactor was tripped and all CRs were fully inserted.
An investigation into the cause of the event and a post transient evaluation was initiated.
Prior to the event all CRs were withdrawn from the reactor core and in Auto, both Main Boiler Feedwater Pumps (MBFPs) {SJ) were in service, the Auxiliary Feedwater Pumps (AFWPs) {BA} were in standby, the emergency diesel generators {EK} were in standby, and off-site power was in service. At 1435 hours0.0166 days <br />0.399 hours <br />0.00237 weeks <br />5.460175e-4 months <br />, indicated reactor power decreased from approximately 99.87% to 50% (based on the Nuclear Instrumentation System power range neutron flux monitors) as a result of 12 CRs dropping into the core. Of the twelve CRs that dropped in:o the core, four (4) CRs (M-12, M-4, D-12, and D-4) went from 223 steps to 150 steps cut and eight (8) control rods (N-13, L-13, N-5, N-3, E-3, C-3, C13, and C-11) went from 223 steps out to 0 steps. Reactivity control is achieved by a combination of 53 CRs [29 (RCCAs) are in control banks (CB) and 24 in shutdown banks (SDB)], and chemical shim (boric acid). The CRs are divided into 1) a shutdown (SD) group comprised of two SDBs of eight rod clusters each and two SDBs of four rod clusters each, and 2) a control group comprised of four CBs contair..ing eight, four, eight, and nine rod clusters.
After the manual RT, seven (7) rod bottom lights for CR SDB A, Rod L7, SDB B, Rod J13, SDB D, Rods F6, F10, K10, CB A, Rod C5, and CB C, Rod C13 did not illumirate. All other reactivity indications were normal. As a result of the manual RT, the Main Turbine-Generator tripped, and the AFWPs automatically starter.. The emergency diesel generators did not start as off-site power remained in service. An alarm for low pressurizer pressure annunciated at approximately 1436 hours0.0166 days <br />0.399 hours <br />0.00237 weeks <br />5.46398e-4 months <br />, as a result of a reduction of the Reactor Coolant System (RCS) pressure to the normal trip setpoint (1985 psig). The decrease in pressure was due to the negative reactivity from the initial rod insertion.
All primary safety systems functioned properly. Unexpected responses included:
Both MEFP suction relief valves lifted (reset at approximately 1458 hours0.0169 days <br />0.405 hours <br />0.00241 weeks <br />5.54769e-4 months <br />), a "Not in Snyc" alarm was received for the 24 Static Inverter (adjusted and cleared), and a low oil level alarm on upper reservoir was received for the 23 Reactor Coolant Pump.
Power for the rod control system is distributed to five power cabinets from two motor-generator sets connected in parallel through two series of Reactor Trip Breakers (RTBs). The ac power distribution lines downstream of the RTBs are routed above the power cabinets through a fully enclosed three-phase, four wire plug-in bus duct assembly.
The ac power to each cabinet is carried by the bus duct assembly through three plug-in fused disconnect switches for the stationary, movable and lift coil circuits of the mechanisms associated with that cabinet. During the investigation of the event, at approximately 1507 hours0.0174 days <br />0.419 hours <br />0.00249 weeks <br />5.734135e-4 months <br />, the disconnect switch {JS} o:a top of rod control power cabinet {CAB} 1AC was discovered to be open.
Opening the disconnect switch caused loss of power to the stationary coils for twelve (12) CRs. The switch that was placed in the open position was for power cabinet 1AC which controls the rods for CB A, Group 1, CB C, Group 1, and SDB A, Group 1. Loss of power to these CRs caused the rods to drop into the reactor core per design. Four (4) CRs partially inserted (223 steps in to 150 steps).
CR power cabinet (1AC) disconnect switch was inadvertently bumped open by a contractor erecting scaffolding around the CR power cabinets in the cable spreading room of the Control Building {NA}. The disconnect switch to rod control power cabinet 1AC was re-closed at approximately 1627 hours0.0188 days <br />0.452 hours <br />0.00269 weeks <br />6.190735e-4 months <br />.
An assessment of the condition by reactor engineering concluded that power was removed from the CR stationary gripper coils when the disconnect switch was opened. When no motion is demanded and rods are stationary, current is sent to the coils, which keeps the grippers engaged on the CR. The CR system sensed the power loss condition and transmitted a high current order to the movable gripper coils which had not lost their power. The movable gripper coils were able to catch four of the CRs as they were falling but did not catch the remaining CRs in the other CR groups. The cause of the failure of seven (7) rod bottom lights to illuminate after the dropped rod event was due to failed light bistables.
On March 1, 2006, at 18:13 hours, a four hour non-emergency notification was made to the NRC (Log Number 42378) for a reactor trip while critical and included the eight hour non-emergency notification for the actuation of the AFW system. Both notifications were in accordance with 10CFR50.72(b)(3)(iv)(A).
The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2006-01012.
CAUSE OF EVENT
The direct cause of the reactor trip was human error. A supplemental worker erecting scaffolding required for an outage modification in the cable spreading area was having difficulty tightening the knuckle on a scaffold pole from within the scaffold platform and stepped outside the envelope of the scaffold, violating directions provided in his pre-job brief, then stepped onto the rod control power cabinet 1AC, in violation of his pre-job brief, in order to get a better angle to tighten a brace. Upon returning to the scaffold envelope, he inadvertently bumped the disconnect switch for the rod control power cabinet (1AC) that provides power to twelve (12) CRs.
The root causes were as follows: RC1: Inadequate work practices and RC2:
Inadequate interface requirements. RC1: Inadequate job preparation practices resulted in the scaffold crew not having a ladder staged at the job site, which would have precluded the need to step onto the cabinet. During scaffold construction, a scaffolder realized that a ladder was needed to reach scaffold connections above the rod control cabinet but none was staged or identified during the pre-job brief. An unsuccessful search was performed for a ladder and work resumed without a ladder. As a result of inadequate acquisition of support equipment (ladders), although cautioned at a pre-job brief not to step on the cabinets, the scaffolder stepped onto the cabinet to reach a connection and bumped the disconnect switch.
RC2: Inadequate interface requirements. The Maximo work flow process for scaffold Work Orders (WO) are generically designated as not requiring Operations (Planning) review to identify operational risks. This process was the result of a change to reduce the amount of WOs requiring a risk analysis. In accordance with the current Maximo work flow process, scaffold WOs go directly from "walk down" or "radiological review" to "ready." This computer program work flow process (Maximo) is in conflict with the work management process (procedure IP- SMM-WM-100) which specifies that Operations Planning must assess risk and complete the plant impact matrix page. This process requires the Shift Manager or designee to authorize work prior to its commencement. The appropriate personnel and department interactions were not fully considered when the new process was created and there was an inadequate evaluation of the risk and consequences prior to making the work process change.
Contributing causes (CC) of the event included the following: CC1: Labels not maintained. The rod control disconnect switches were not labeled and not identified as a unit trip risk. The scaffold worker was not aware of the trip risk. CC2: Work planning was not coordinated with all departments involved in the task. No physical barriers were provided to preclude a change in switch position, even though it represented a high risk to plant operation.
An extent of condition assessment was performed for other work with the potential for Human Error (HE) leading to a trip. Insulation WOs and Fix-It-Now (FIN) minor maintenance WOs also bypass the Operations Planning review for risk assessment. However, FIN WOs require a licensed operator review. Corrective actions for this event have been identified to prevent insulation WOs from bypassing Operations planning review. HE will be managed through in-field supervisor presence, HE training, strict enforcement of standards and expectations and removal of error traps.
CORRECTIVE ACTIONS
The following corrective actions have been or will be performed under the CAP to address the causes of this event and prevent recurrence.
- A stand down was held for supplemental employees and Maintenance support personnel. Personnel were coached on the event and lessons learned, the need to be vigilant when working around operating equipment, and the need to identify any potential trip risks during the initial pre-job brief. Personnel were coached on management's expectation for discussing tools and equipment required during the pre-job brief and the need to stage or reserve such items prior to the start of work. Error traps leading to the event were included in the coaching. Reinforced the requirement to start scaffold work only with a controlled copy of a Work Order to Maintenance Support Supervisors.
- Interim measures were implemented to require the Operations Field Shift Supervisor (FSS) review and approval of scaffold Work Orders (WO). The FSS is also to sign the controlled copy of the WO. WOs for scaffolding considered a trip risk or other impact, require a meeting with the scaffold foreman prior to the WO taken to in-progress. In addition, scaffolding considered a trip risk but approved for construction requires the scaffolding group to check with the FSS each shift/day and for the FSS to conduct a briefing on the risks.
- A briefing will be performed with supplemental employees reporting to Maintenance Support of the meaning of trip risk as it applies to the station.
Corrections are scheduled to be completed by May 1, 2006.
- The Maintenance Support pre-job walk down check list for scaffold work will be revised to include a review for the need of physical barriers for trip risk equipment. Revision of the check list is scheduled to be completed by June 30, 2006.
- The scaffolding procedure (0-SYN-014-GEN) will be revised to include a requirement that Operations be notified prior to construction of scaffold in safety related areas, and the pre-job briefing checklist, Attachment 3 will be revised to include staging of tools and equipment required for a job.
Procedure revision is scheduled to be completed by June 30, 2006.
- The computer work flow process will be corrected so that it matches the procedural requirements of the work management process (IP-SMM-WM-100) and includes an opportunity for operational impact/trip risk review. Corrections are scheduled to be completed by August 14, 2006.
- The disconnect switches for the rod control cabinets for units 2 and 3 will be labeled as unit trip risks. The labeling is scheduled to be completed by August 14, 2006.
EVENT ANALYSIS
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS) including RT and AFWS actuation. This event meets the reporting criteria because a manual RT was initiated at 1435 hours0.0166 days <br />0.399 hours <br />0.00237 weeks <br />5.460175e-4 months <br />, on March 1, 2006, and the AFWS actuated as a result of the RT.
PAST SIMILAR EVENTS
A review of the past three years of Licensee Event Reports (LERs) for events that involved a RT from dropped CRs did not identify an applicable LER. A review for LERs related to RTs caused by inadvertent personnel actions identified LER-2004- 005. LER-2004-005 reported an automatic RT due to a Main Generator-Turbine trip as a result of low generator stator cooling water pressure. While investigating a high generator stator cooling water flow abnormality, a Nuclear Plant Operator inadvertently bumped a component in the flow controller during adjustment of generator cooling water flow that caused a pressure switch to close, initiating the Generator protection circuit. LER-2004-005 is similar in that an inadvertent personnel action caused a RT. However, the event reported in LER-2004-005 had a different cause. The cause of that event was an improperly set generator cooling flow control valve. Although an inadvertent action initiated the event, the action to adjust the flow would not have been necessary had the generator stator cooling water flow valve been properly adjusted. LER-2006-001 was a result of human error and not a result of action necessary to correct a previous condition.
SAFETY SIGNIFICANCE
This event had no effect on the health and safety of the public.
There were no actual safety consequences for the event because the rod control system and RPS operated as designed. CR design is to fail safe upon loss of power. The inadvertent loss of power to a portion of the CRs resulted in the rods dropping into the core. Control room indications (Rod Bottom lights) and alarms (Rod Supervision) alerted operators to the condition and the remaining CRs were dropped into the core through manual actuation of the RPS. The requirement to trip the reactor as a result of dropped rods is contained in plant procedure 2-A0P-A0D-1 and was initiated approximately 17 seconds following indications of dropped CRs. The event did not initiate any transients or accidents and the plant safely shut down as designed. All safety systems functioned as designed and no operational limits were exceeded. The reactor coolant radioactivity concen:rations showed no signs of fuel cladding problems as a result of the event therefore the departure from nucleate boiling and peaking limits were never challenged as a result of this event.
There were no significant potential safety consequences of this event. The Reactor Protection System (RPS) is designed to automatically actuate a RT for any anticipated combination of plant conditions, when necessary, to ensure a minimum departure from nucleate boiling (DNB) ratio (DNBR) equal to or greater than the applicable safety analysis limit DNBR. In addition to automatic RT, manual RT is also available. Manual RT for multiple dropped rods is required by plant procedures and operator training includes scenarios of multiple dropped rods.
- The manual RT actuating devices are independent of the automatic trip circuitry.
Also, :here are other protective trips. The RPS monitors parameters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding damage caused by DNB, and to protect against reactor coolant system damage caused by high system pressure. DNB is prevented by the RPS by monitoring plant variables affecting DNB [i.e., thermal power, coolant flow, coolant temperature, coolant pressure, core power distribution (hot channel factors)] and initiating a RT when applicable limits are reached. Plant parameters used to protect against DNB include the Over temperature Delta T trip, the Low Pressurizer Pressure trip to protect against excessive core voids that could lead to DNB, and the Overpower Delta T trip to protect against excessive power (fuel rod ra:ing protection) all of which initiate a RT. Therefore, there are no reasonable or credible alternative conditions that would have resulted in serious consequences.