05000286/LER-2013-005
| Event date: | 3-27-2013 |
|---|---|
| Report date: | 5-23-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| ENS 48854 | 10 CFR 50.72(b)(3)(iv)(A), System Actuation, 10 CFR 50.72(b)(2)(iv)(A), System Actuation - ECCS Discharge |
| 2862013005R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On March 27, 2013, while in Mode 3 during startup from the Cycle 17 refueling outage (3R17), an inadvertent safety injection (SI) occurred at approximately 6:01 hours, during performance of surveillance 3-PT-M13B (Reactor Protection Logic Channel Functional Test). The SI signal also initiated a safeguards equipment signal, auxiliary feedwater system actuation, containment ventilation isolation, and containment phase A isolation. The safeguards equipment signal initiated Reactor Protection System (RPS) actuation, start of the Emergency Diesel Generators (EDGs), and containment fan cooler unit (FCU) actuation. The EDGs started but did not load as offsite power remained available. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as Condition Report CR-IP3-2013- 02115.
Performance of 3-PT-M13B commenced at 5:40 hours on March 27, 2013, with Reactor Coolant System (RCS) pressure at approximately 1200 psig and RCS temperature at approximately 390 degrees F. Test Section 2.3.2 (Precautions and Limitations) specifies that pressurizer (PZR) pressure must be above 1930 psig to perform the test but if the plant is shutdown, signals may be installed to simulate the condition. The simulation signals are installed and removed under Appendix A to the test. The low pressurizer pressure trip shuts down the reactor in case of an RCS break and serves as a backup to the steam break protection logic for the secondary plant. There are four pressure transmitters but only three of them provide input to the SI function. Three pressure channels are arranged in two out of three (2/3) logic to initiate a SI at 1720 psig. This trip can be manually blocked on an RCS cooldown once below 1900 psig as sensed by 2/3 channels. The signal is automatically removed when pressurizer pressure exceeds 1920 psig.
During implementation of 3-PT-M13B, Appendix A, helipot installation is directed for the PZR pressure channels to allow PZR pressure signals to be simulated. In accordance with Appendix A of the test, a helipot was first installed in pressure transmitter (PT)-455 and then simulated pressure was raised above 2000 psi. A second helipot was installed in PT-456 and again simulated pressure was raised above 2000 psi. SI is automatically enabled with 2 channels above 1900 psig but one of the two out three channel pressure signals remained below the 1720 psig signal required for SI actuation.
During this time the plant is susceptible to an SI actuation if one of the inputted signals is lost. Before pressure could be simulated in the remaining transmitter (PT- 457), the test lead connected to PT-456 failed open causing the system to register a 2/3 PZR low pressure satisfying the logic for SI actuation.
An Extent of Condition (EOC) review determined the test is normally performed while online where simulation of signals is not required. Therefore, this event can only occur if the test is performed during an outage and the SI is armed. The condition does not apply to unit 2 as the Unit 2 test does not allow the injection of simulated signals.
Cause of Event
The direct cause of the inadvertent SI was a faulty test lead that failed open during testing. The test lead failure occurred when the plant was vulnerable when the signal was raised above the SI enable unblock setpoint. The following root causes (RC) were identified: RC1: The test procedure did not contain steps to preclude nor did it recognize the risk of a single point failure. This condition was a latent procedure issue that was missing critical information associated with inputting simulated signals. The test procedure contains a weakness in the methodology for applying PZR signals in Attachment A. As written, each of the signals are brought up past 1900 psig independently. The SI block is automatically enabled after 2 of the 3 signals exceed 1900 psig. This makes the plant susceptible to an SI actuation if one of the inputted signals is lost prior to the remaining channel has raised above the SI enable setpoint.
To prevent this the test was revised to take all three PZR signals above the 1720 psig SI trip point, but not exceed the 1900 psig thereby allowing SI to remain blocked.
RC2: Manufacturing defect of a test equipment lead. An intermittent open test lead resulted in a momentary lost signal when the lead was manipulated. RC3: Plant personnel did not sufficiently evaluate the risk of when the test was being performed in relation to the impact on the plant. Performing 3-PT-M13B in Mode 3 at low RCS pressure was not adequately evaluated in terms of the impact on the Technical Specification (TS) and plant. Simulating pressure signals via the helipots resulted in Function 7 of TS Table 3.3.2-1 to be inoperable which was not recognized and consequently not appropriately assessed. In addition, the simulated PZR pressure signals resulted in the loss of automatic actuation capability for both PZR pressure PORV's. Manual operability of PORV operation was unaffected. Had these impacts been recognized, additional oversight and reviews would have been required.
Corrective Actions
The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the cause of this event.
- The defective test lead was removed from service.
- The remaining test leads were inspected and tested to ensure there are no other defective test leads.
- Procedure 3-PT-M13B will be revised to remove single point vulnerability.
- A TEAR will be initiated to create a Case Study for this event which will include information associated with performing in depth risk assessments when surveillance tests are added to or removed during an outage.
- The TEAR initiated for the Case Study will be incorporated into operations continuing training.
- A review will be performed on the acceptability of performing the test in Mode 3 at low press.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A), any event or condition that resulted in manual or automatic actuation of any of the systems listed in 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS), general containment isolation signals affecting containment isolation valves in more than one system or multiple main steam isolation valves, Emergency core cooling systems (ECCS) including intermediate head and low pressure injection function of the residual heat removal system, auxiliary feedwater system, containment heat removal and depressurization systems including containment spray and fan cooler systems and emergency ac electric power systems including emergency diesel generators.
This event meets the reporting criteria because an SI actuation was initiated. The SI signal also initiated a safeguards equipment signal, auxiliary feedwater system actuation, containment ventilation isolation, and containment phase A isolation. The safeguards equipment signal initiated start of the Emergency Diesel Generators (EDGs), Reactor Protection System (RPS) actuation, and containment fan cooler unit (FCU) actuation. The EDGs started but did not load as offsite power remained available. An immediate notification was provided by EN# 48854 on March 27, 2013 at 7:30 hours.
Past Similar Events
A review of the past three years of Licensee Event Reports (LERs) for events that involved inadvertent SI actuation did not identify any events.
Safety Significance
This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients during the time of the event and the SI actuation was not in response to an actual condition or event requiring mitigation. Due to the SI signal, the SI pumps automatically started and water from the Refueling Water Storage Tank was injected into the RCS cold legs. Actual pressurizer level was maintained less than 100% and the steam bubble along with RCS pressure control was maintained. The pressurizer safety valves did not lift during the transient. For this event SI was terminated with RCS temperature at approximately 390 degrees F which is above the 10CFR50, Appendix G limit of 380 degrees F. The primary to secondary side differential pressure limit of 1700 psid was not exceeded as a result of the event. Following the inadvertent SI, the pressurizer heatup rate exceeded the 100 degree F/ hour limit associated with Technical Requirements Manual (TRM) TRO 3.4.D during system restoration. An evaluation of this condition concluded the structural integrity of the pressurizer was acceptable.