05000286/LER-2014-003
| Docket Number | |
| Event date: | 2-06-2014 |
|---|---|
| Report date: | 4-07-2014 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2862014003R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On February 6, 2014, while at 100 percent steady state reactor power, at approximately 15:53 hours, the Control Room (CR) {VI) Operators observed a "Non- Safety Injection (SI) Blackout Logic Defeated" alarm {PA} clear, reset push-button {HIS} light {IL} on, the "Auxiliary Boiler Feedwater (ABFW) {BA} pump {P) 32 Steam Supply Low Pressure" alarm {PA) clear, and 32 ABFW pump RPMs increasing during performance of a monthly functional test (3PT-M79A) of the 31 Emergency Diesel Generator (EDG) {EK). The clearing of the "Non-SI Blackout Logic Defeated" alarm was not expected at the time of the test since the reset push-button had not been pushed. The EDG functional test closes and opens the EDG output breaker {BRK} via a breaker control switch, connecting and disconnecting the 31 EDG to 480 Volt AC Bus 2A/3A. The ABFW Pump start logic {JE} is defeated during this test. The "Steam Supply Low Pressure" alarm is normally locked-in (Green) when the 32 ABFW pump is not in service. The clearing of the "Steam Supply Low Pressure" alarm alerted operators to an automatic start of the turbine driven pump. Operations determined that there were no plant conditions requiring operation of the 32 ABFW pump. The 32 ABFW pump was shutdown at approximately 16:08 hours, and placed in standby at approximately 16:10 hours. The 31 EDG was shutdown and its control switch was placed in "Auto" at approximately 16:02 hours. The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP3-2014-00368.
Operations initiated an investigation into the cause of the event. The 32 ABFW pump auto-started after the 31 EDG output breaker to 480 Volt AC {ED} Bus 2A/3A was manually opened. Auxiliary Feedwater (AFW) from the 32 ABFW pump did not flow to the steam generators (SG) due to the normally closed condition of manually operated Flow Control Valves {FCV} (BFD-FCV-405A,B,C,D). An assessment by Instrumentation and Controls (I&C) verified that no unexpected alarms were received, and that no other actuation or trips were initiated. I&C and Operations verified that none of the conditions that automatically actuate the 32 ABFW pump (Non-SI Blackout signal, a Low-Low level in two of the four SGs, or AMSAC signal) were present during the time the 32 ABFW pump auto-started and ruled out these scenarios. In response to a request by Operations, Engineering performed an Operability Evaluation (OE) concluding that the 32 ABFW pump was operable with compensatory measures required to maintain operability. The OE determined that resetting SI after a loss of offsite power (LOOP) and SI actuation will cause the 32 component cooling water pump (CCW) and 32 ABFW to auto start. The 32 ABFP does not have a timer and auto started when the start logic was made up. The 32 CCW pump did not auto start as it has a timer and it had not run down before the EDG output breaker was opened. The 32 CCW pump was secured and placed in Trip Pull Out (TPO) to prevent unnecessary loading onto the EDG. An existing approved calculation demonstrates that the additional load on the 31 EDG imposed by the 32 CCW pump auto starting is within current safety analysis. Starting of the 32 ABFP is acceptable as it will stay in idle, its discharge flow control valves are closed and it will draw a minimum amount of steam.
The 480 volt AC Electrical Distribution System {ED} contains three safeguards power trains. The three safeguards power trains are train 5A (480 volt bus 5A and associated EDG-33), train 6A (480 volt bus 6A and associated EDG-32), and train 2A/3A (480 volt buses 2A and 3A and associated EDG-31). 480 volt safety buses (5A, 6A, 2A and 3A) and associated switchgear {SWGR} contain Non-SI Blackout Logic relays (3-2/5A, 3-2/2A, 3-2/3A, and 3-2/6A). These relays are energized when: the Non-SI Blackout Logic is not defeated, the EDG breaker is racked in, the EDG breaker is closed, and the bus undervoltage is clear.
Corrective Actions
The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event.
- The 31 EDG Non-SI Blackout Logic Defeated reset pushbutton was replaced.
- The remaining pushbutton that has not been replaced will be changed out with a new pushbutton
- Surveillance procedure 3PT-M79A and other procedures that utilize the Non-SI Blackout Logic Defeated reset pushbutton will be modified to add a verification to check to ensure the pushbutton is not left in the depressed position.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include AFWS actuation. This event meets the reporting criteria because an automatic AFWP actuation was initiated at 15:53 hours, on February 6, 2014. On February 6, 2014, an 8-hour non-emergency notification was made to the NRC at 20:17 hours, for a valid actuation of the AFW System (Event Log #49802) under 10CFR50.72(b)(3)(iv)(A).
As a result of the event, there were no safety systems that were not capable of performing their safety function. In accordance with reporting guidance in NUREG- 1022, an additional random single failure need not be assumed in that system during the condition. Therefore, there was no safety system functional failure reportable under 10 CFR 50.73(a)(2)(v).
Past Similar Events
A review was performed of the past three years for Licensee Event Reports (LERs) reporting a AFWP actuation. Two candidate LERs were identified. LER-2011-005 reported on an automatic actuation of the EDGs and AFWPs on August 19, 2011, due to undervoltage on 480 volt AC vital buses as a result of a loss of offsite power during a severe storm. LER-2013-005 reported an automatic actuation of safety Injection and Engineered Safety Features on March 27, 2013, during reactor protection system functional testing. LER-2011-005 did not have a similar cause as it was due to a loss of 138 kV offsite power due to lightning effects on a deficient ground grid. LER-2013-005 reported the AFWP and ESF actuation was due to faulty test lead, inadequate test procedure, and inadequate risk evaluation.
This event has similar aspects as it was due to faulty equipment for testing (reset pushbutton vs test lead).
Safety Significance
This event did not have an effect on the health and safety of the public. The ABFW pump did not actuate for any condition that required mitigation action to protect the public health and safety. Although the pump was actuated it was not delivering flow to the SGs or operating at design conditions. The effect of the auto start was that the pump started and operated at idle awaiting operator action. Operators could stop pump operation or place the pump in service as conditions warranted.
The design of the AFW System is for the turbine driven ABFW pump to provide FW to the SGs during a station blackout or if both motor driven ABFW pumps are unavailable. There was no station blackout and both motor driven pumps (ABFW 31, 33) were available at the time of this event to provide AFW.
There were no significant potential safety consequences of the event under reasonable and credible alternative conditions. If this event occurred during a design basis accident it would not have affected accident mitigation capability.
The failed switch would not have prevented applicable EDGs from starting, bus loading, or the ability to provide AFW. An engineering evaluation determined that EDG 31 would perform its design safety function during a Design Basis Accident (DBA) with no overloading if a component assigned to bus 2A/3A (e.g., 32 CCW pump) did not sequence and was loaded on the bus.
Engineering review of design documents concluded the failure of the reset circuit did not adversely affect the safety of the plant, the EDGs or Engineering Safeguards Features. Engineering's basis is as follows: 1) The degradation of the reset circuit does not prevent the actuation or reset of any components in response to a loss of offsite power (LOOP) event, 2) The degradation of the circuit does not prevent the actuation of any components in response to a SI condition and has minimal effect on reset functions, 3) The degradation of the circuit does impact EDG loading during an SI/LOOP condition however, current analysis concludes that the 31 EDG can support the additional load and satisfactorily perform its design function during a LOOP/SI actuation when there is a failure of any one 480 volt safety bus load breaker to trip, 4) The condition will also result in starting of the 32 AFWP when resetting SI but this condition has been determined not to adversely affect the safety of the plant since the AFWP will start and run at idle speed only, draw off minimal amount of steam and go into recirculation mode as the AFWP discharge flow control valves are closed and require manual action to open.