05000289/LER-1990-001, :on 900107,inadvertent Trip of Reactor Protection Sys Occurred,Followed by Inadvertent Engineered Safeguards Actuation Sys Actuation.Caused by Inadequate Procedural Detail.Procedure Improvements Made
| ML20011E426 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 02/06/1990 |
| From: | Hukill H, Knight M GENERAL PUBLIC UTILITIES CORP. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| C311-90-2011, LER-90-001, LER-90-1, NUDOCS 9002130389 | |
| Download: ML20011E426 (8) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(b)(2)(ii) |
| 2891990001R00 - NRC Website | |
text
... -...........
i
, O ',
$y yl' f
OPU Nuolest Corpotetton l!
- h.
gg 7
Post Office Box 480 Route 441 South.
y Middletown, Pennsylvania 17057 0191 i
717 944 7621 4
TELEX 84 2386 Writer's Direct Olal Number:
Pobruary '6, 1990 C311-90-2011 L
U.S. Nuclear Regulatory Commission Attn:
Document Control Desk E
Washington, DC 20555 P
Dear Sir n
Three Milo Island Nuclear Station, Unit 1 (TMI-1)
Operating Licensing No. DPR-50 Decket No. 50-289 LER 90-001-00 This letter transmits Licensco Event Report (LER) No 90-001-00 regarding an inadvertent Reactor Protection System (RPS) actuation and Emergency Safeguards Actuation System (ESAS) actuation due to inadequate procedural detail and personnel error during surveillance testing on January 7, 1990 while the plant was in cold shutdown crN41tions.
Public health and safety were unaffected.
W M LER is being submitted pursuant to 10 CFR 50.73, using the 1 %,u i r e d N R C f o r m s ( a t t a c h o d ).
NRC Form 366 contains an abstract naich provides a brief description of the event.
For a complete understanding of the event, refer to the text of the report which appears on Form 366A.
Sincerely,
'/
D.
ki Vice President and Director, TM1-1 HDH/MRK Attachment cc J. Stols
- - R. Hernan F. Young W. Russell 9002130389 900206 PDR ADOCK 05000289 S
PDC g
\\
' GPU Nuclear Corporation is a subsidiary of the General Public Utilities Corporation
.,.e su u==a*. meu6 m.minen e.
.aiove. om i.o sim UCENSEE EVENT REPORT (LERI
- u em a i
THREE MILE ISLAND UNIT 1
~
- 0 151010101 21819 i lor 01 7 i
INADVERTENT REACTOR PROTECTION SYSTEM AND EMERGENCY SAFEGUARDS ACTUATIONS DUE TO
}
INADEOUATE PRorrhuRr AND PERSONNEL ERROR evem on e a m.m...
,=nm er...ciuvim 6ve..,
1 MohTm 0y vs..
78.
M k' 4
. 18 @
.04,.e DT WI..
C4't v.wes DOCILIT %vw.tensi I
0151010 10 1 I
Q1 0l 7 90 9 l0 0l0 h 40 0l2 Oj6 9 l0
~
o,sio,o,o,,,
va
,.um.irno.wvanver
.ui c.
C.e,
,nu
=aa
- N
=
mei emimmi n.,i.i a
m.mmmm m mi.nu
.imime.i n.,u.i y
0, O 0 m esi.imm m m..
mn.
e...
i g,, g,g t
m e inum mainini m a im. n.i m.,
= =wma.i maimm mmim.
m me.iftiM
..t.leHet mmieHai 6=
n
.ev v. am nei h.
n a, o. ~v i
M. R. Knight. TMI-1 Licensing Engineer 117 94 i 8,,8SS4 1
i i i i
+
.aupan u= m.
== mummee.
=v.==,nei Caull
$Y8ttu CO.#ohth, "l
$0' To fg Cav.8 OvM9.
CO 04th, "j glC p
,5 9 i
E i
I i e i 1 i i
i i i 1 #
! l !
l l 1 l
i l i i l !
.u amm.6==,..eno n.
.om -
e.,
,,,y,
7 vu o,
. - aveene m
,o= u ni T1 =o
'tl**"i"i??
i i
i i
M..c, m,....
= = -,., n o.
TMI-1 was in cold shutdown conditions on January 7, 1990 with the "A" Decay Heat Removal System in operation.
% surveillance was being performed.
At 12:04 p.m.,
an inadvertent trip of the Reactor Protection System (RPS) occurred, followed at 2:13 p.m.
by an inadvertent Engineered Safeguards Actuation System (ESAS) actuation.
These actuations are being reported in accordance with 10CFR50.73(a)(2)(iv) as a single event.
The cause of the RPS actuation was inadequato procedural detail.
Personnel error (contractor technician inexperience, inadequate supervision and poor communications) contributed to the RPS actuation and caused the ESAS actuation.
All safety systems performed as designed.
There were no adverse safety consequences as a result of this incident.
With the plant in cold shutdown, the impact was minimal.
Corrective actions include:
- 1) providing direction to shift Supervisors / Shift Foremen to increase their involvement in tests that could result in a similar event while shutdown,
- 2) providing direction to maintenance supervisors to ensure an adequate understanding of the procedure before assigning contractors to procedures where a similar event could result,
- 3) ensuring GPUN and contractors are adequately briefed, and
- 4) procedural improvements to this and other procedures with the potential for inadvertent safety system actuations.
eE, ' **
p i
L.-
WRC Deem W i
U S WOCLEah blGutitOav COMMiettosi
'"[
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION amovio oMe =o me-cios innais eme.
DAC6LITV soment qu pact 41 wueette Las att kuMDth ela tact ta
~
"tc."
W.T.
iaa THREE MILE ISLAND, UNIT'l o pjojojol @ % % % (
0l0l1 0l 0 0l 2 0l 7 or vus v
. = = - =c w an.emi Inadvertent Reactor Protection System and Emergency Safeguards Actuations Due to Inadequate Precedure and Personnel Error (Event Date 1/7/90)-
I.
Plant Operating Conditions before Event:
TMI-l was in the Cold Shutdown condition during the cycle S Refueling (BR) Outage which began with plant shutdown on January,5, 1990.
The "A" Decay Heat Bemoval System train [BP/--)
was in operation.
Testing was in progress using the Reactor Building Spray Pressure Instrumentation section (Subsection B) of Surveillanco Procedure 1303-11.18 " Local Leak Rate Testing."
II.
Status of Structures, Components, or Systems that were Inoperable at the Start of the Event and that Contributed to the Event:
None.
III.
Evont Description:
At approximately 12:04 p.m. on January 7, 1990, an inadvergent trip of the Reactor Protection System (RPS)
[JC/--)
occurred, which caused a Reactor Trip Iao various Reactor Building Isolation valves [JM/ISV)}ation of At approximately 2:13 p.m.,
during the same test, an inadvertent actuation of the "B" train of $ho Engineered Safeguards Actuation System (ESAS) [JE/--)
occurr causing the "B" cmcrgency diesel generator [EK/DG)gd l
to start, the "B" decay heat removal pump [BP to start, and the expected isolation valves [--/ISV)fP)to close.
Safety system actuation is reportable in accordance with 10CFR50.72(b)(2)(ii) and 10CFR50.73(a)(2)(iv).
These actuations are being reported as a singlo event.
Both actuations occurred during performance of the same procedure, within approximately two hours.
The Instrumentation and Control (I&C) group foreman in chargo had required the three technicians involved to review the procedure and he briefed them on the activity.
The three man crew consisted of onc experienced GPUN I&C technician and two inexperienced contractor I&C technicians.
One contractor technician accompanied the GPUN I&C technician into the Reactor Building (RB) [NH/--)*
to pressurize, leak test, and depr RB pressure sensing lines [JM/PDT)gssurize cach of the four The second contractor technician was assigned to the control room to communicate 7J '5 "" ""
i
--b
W *.= anna u a wuctiu onouetoav commissios.
1 4
UCENSEE EVENT REPORT (LER) TEXT CONTINUATION maovio oue =o mo-em
{
=,iais mi j
.vi,su.* ni u.., w.. in, f
"bla;r
rJ,n THREE MILE ISLAND, UNIT 1 o pjojojol2l8l9 9;O 0 l0 l1 0l0 0l3 0 l7 or with the technicians in the reactor building via I
headphones, reading and signing off the procedure steps, and to interface with a GPUN Control Room Operator (CRO) in resotting the channel trips before proceeding to the next channel.
Each of the four RB spray pressuge instrument lines actuates an RPS channel [JC/CHA) 'and a H Protection System (HSPS) channel [JB/CHA) gat Sink Three of the four RB spray pressure instrument lines ogch actuate an,
ESAS channel.
& LPI [BP/--)
portions) actuations were bypassed to prevent actuation in accordance with the proceduro.
The "A" RB pressure channel was tested first.
The pressurization resulted in the expected "A" RPS and ESAS channel trips.
When the "A" RB pressure instruments were depressurized, the contractor I&C technician in the control room asked the CRO (CRO "A") to reset the trips per the procedure.
The CRO reset the ESAS chann pressure contact buffer modulo [JM/IMOD]gl trip and the RB but did the Channel A Reactor Trip Modulo (RTM) [JC/IMOD),not reset leaving RPS Channel A in a tripped state because the procedure did not specify that the RTM was to be reset.
The "B" RB pressure channel testing was begun without recognizing that the "A" RPS channel was left in the,
tripped state.
In addition to the expected ESAS channel trip, the pressurization resulted in a second trippc6 RPS channel (Channel B) causing a Reactor Trip Isolation, tnd closing the expected isolation valves at approximately 12:04 p.m.
This trip condition was reset by another CRO (CRO "B").
The Operations shift Supervisor directed the I&C crew to depressurize the equipment under test and to stop work until the cause of the trip was understood.
At this point the I&C crew broke for lunch.
Approximately one hour later the Shift Supervisor informed the I&C crew that the event was caused by failure to reset the RTM and that they could resume testing.
During the lunch break, a review of the leak rate data on the RB pressure instrument lines indicated that there was a leak in the leak rate test rig.
This was confirmed and the leak was repaired so that leak rate data on the "C" and "D" RB pressure instrument lines would be valid.
The data on the "A" and "B" RB pressure instrument lines was known to be invalid, so the leak rate test would need to be repeated on those instrument lines.
The I&C technicians took up the (3,o.. ma c
^
i
' tint Pem EBha W8 huC41 R hl0941108V CanaW8SIDW
- "l UCEN,$EE EVENT MPORT (LER) TEXT CONTINUATION
.*aovio ove ao aww soass som
)
..C.uv.
n,
m......,
"t d F
~~' Et.?:
)
iaa THREE MILE ISLAND,. UNIT 1 o ls jo lo lo l2l8l 9 9l 0 0 l0 p 0l0 04 or 0 l7 1
tem
..-w..
-== =.muunn j
s same Reactor Building and Control Room positions to continue.
1 The "D" RB pressure channel was tested next at t
approximately 1:54 p.m.
The pressurization resulted in the expected "D" RPS channel trips.
When the "D" RB pressure instruments were depressurized, the contractor I&C f
technician in the control room asked CRO "B" to reset the trip por the procedure.
The CRO reset the RB Pressure contact buffer module and the "D" channel reactor trip module completing the action implied by the procedure.
There is no ESAS actuation associated with the "D" RB i
pressure instrument.
The "C" RB pressure channel was tested next at approximately 2:04 p.m.
The pressurization resulted in the expected "C" RPS and ESAS channel trips.
When the "C" RB pressure instruments were depressurized, the contractor I&C technician in the Control Room asked a third CRO (CRO "C")
to reset the trips per the procedure.
The CRO roset the RPS channel "C" RB pressure contact buffer and reactor trip i
module and three of the four ESAS trips, but did not reset ESAS channel RB3B, as required by the procedure.
This was
[
not recognized and due to inadequate communication of the actions taken compared to the actions called for in the procedure, the step was signed off as having been done.
i The "B" RB pressure channel was pressurized to repeat the leak rate test at approximately 2:13 p.m.
The pressurization resulted in the expected "B" RPS trips as well as the tripping of a second ESAS channel causing the i
inadvertent ESAS actuation which started the "B" Emergency Dioscl Generator and the "B" Decay Heat Removal Pump and closed the expected isolation valves.
The "B" Decay Heat Removal Pump started and ran on recirculation until it was shut down manually.
Because the suction yalve from the Borated Water Storage Tank (BWST) [BP/TK) was closed and tagged with the breaker open, no Emergency Safeguards (ES) injection occurred.
The "A" Decay Heat Removal Pump was already in operation recirculating the Reactor Coolant System.
Decay heat removal cooling was not interrupted.
The cause of the inadvertent RPS actuation was a lack of detail in the procedure in that the proceduro did not give the instruction to reset the RTM.
Personnel error caused the inadvertent ESAS actuation and contributed to the RPS actuation.
A contractor technician was allowed to perform a procedure without adequate familiarization with the procedure and without adequate supervision.
The CROs were not sufficiently involved in this test to question what was g;p...
+-
3 g,,*-- maa v s wucana nieveson, com.< moi, UCENSEE EVENT REPORT (LER) TEXT CONTINUATION oraavap om ~o me,ou s o.= s em a 4Cthaty haast m exact wumeth un g gp 4 j
n**
"tL::'
2,7,7:
0l7
)
THREE MILE ISLAND, UNIT 1 o p jo jo jo l 2l 8l 9 9; 0 0 l0 l1 0;0 0;5 or em u
..-=. - ~ wc w. m w nn to be reset.
The Shift Supervisor / Shift Foreman were not involved in verifying channel reset as they would if the j
plant were operating.
i Communications between the technician and the CRO did not i
compensate for the inadequacy of the proceduro nor the technician's lack of a detailed usrstanding of the actuation systems when the CRO f&i; d to properly roset the previously tested channel.
j i
IV.
Component Failuro Data
]
5 No component failurcs were associated with this event.
1 i
V.
Automatic or Manually Initiated Safety System Responses:
A.
The RPS actuation resulted in the expected component actuations as described in Section III above.
B.
The ESAS actuation resulted in the expected component actuations as described in Section III above.
Due to the tag out of equipment for plant shutdown, many components that would normally receive the actuation signal did not change status.
VI.
Assessment of the Safety Conf 4quencds and Implications of the Event:
All safety systems performeci as designed.
There were no f
adverse safety consequences as a result of this incident.
No equipment damage resulted and no loss of decay heat i
removal function occurred.
With the plant in cold shutdown, the impact of the RPS actuation was minimal.
The reactor was already tripped.
The Reactor Trip Isolation (RTI) caused only minor inconveniences to rgstart the RB purgo [VA/ FAN) and restore the RCS [AB/--)
vent path.
The impact of the ESAS actuation was also minimal due to the plant shutdown condition.
Except for the Emergency Diescl Generator (EG-YlB) fast start, the Decay Heat Removal Pump (DH-PlB) start, and the valvo closures that occurred as expected, Train B of the ESAS was deactivated due to plant conditions.
The procedure that was being performed would not have been accomplished at power.
If under other circumstances a similar RPS actuation were to occur at power, the significance would be greater; but the expected plant response would be no different from that of a typical reactor trip without complications.
If a similar ESAS ge...
m e anna u,wuc6:n neutuoavcom im.
l L6CENSEE EVENT REPORT (LER) TEXT CONTINUATION
- aotto o== *o me.cm.
i=*ais em es Facialfv haast np Dx as1 huest a m tlk wouet h 166 tapt tai n**
"t?.W
%'.T:
0 l7 THREE MILE ISLAND, UNIT 1 o p.10tolol2l8l9 9l 0 O l0 l1 0l0 0l6 or eint w
=c mu o ni, actuation were to occur at power, the safety implications and consequences would not be significantly different, although boric acid injection into the RCS may cause a power reduction.
VII. Previous Events of a Similar Nature:
The LERs listed below involved either an inadvertent RPS or an ESAS' actuation, although the specifics of these events were different:
Reactor Trip Events:
LER No.
Date
Cause
88-004 08/13/88 Inadequate procedural guidance 87-006 06/12/87 operator error 87-004 05/02/87 operator error 86-010 04/23/86 Operator error ESAS Actuation Eventst LER No.
Date
Cause
89-001 10/30/89 operator error 85-001 06/25/85 Operator error VIII. Corrective Actions Planned:
A.
Maintenance supervisors will be directed to ensure that contractor technicians under their supervision adequately understand the procedures they are assigned to perform.
The technicians will be thoroughly briefed prior to performance of the activity in order to ensure their understanding, or an appropriate icvel of direct supervision will be provided.
B.
Surveillance Procedure 1303-11.18 " Local Leak Rate Testing" will be revised to clarify the intended actions and verifications in order to minimize the potential for personnel error to result in a safety system actuation.
This procedure, which as discussed above contributed to the occurrence of this event, will be revised prior to its next performance.
C.
Operations shift Supervisors / Shift Formen will be directed to verify the bypassing and resetting of safety system actuation channels while shutdown the same as they would at power, and to ensure that crews are adequately briefed.
D.
A review will be conducted of surveillance procedures identified as having the potential for causing a safety system actuation.
Procedure changes will be made as g,,y..
e
W'*"*erm Sua u $ teuchElG DieptiTDay ceanusessone a
UCENSEE EVENT REPORT (LER) TEXT CONTINUATION
- aovio owe o mo+o.
sa, mss em u 94@Pkff T featti tu 900661 espensta 43, Llm tipMpt$ 141 P&Og (3 bl %",j ',* k
- yh vlam 90, 0 l0 l1 0 l0- 0l7 0 l7 THREE MILE ISLAND, UNIT 1 o p lo lo lo l 2l Bl 9 1
or
- vanu,
-.= w an.vm, necessary to provide clarity.
In addition, the procedures will require t. hat the Shift Supervisor be informed of the potential for a channel actuation, so that he can brief involved personnel and provide written permission to proceed.
[
This review is currently in progress.
Guidance to be used for this review has been provided.
Judgement will be applied to determine which procedures require change prior to performance.
Schedules are being established to ensure the remainder are revised expeditiously.
- The Energy Industry Identification System (EIIS), System Identification (SI) and Component Function Identification (CFI)
Codes are included in brackets, "[SI/CFI)", where applicable, as required by 10 CFR 50.73(b)(2)(ii)(F).
D
(
L h
g,....