05000289/LER-2012-004
| Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. N/A 05000 | |
| Event date: | 08-22-2012 |
|---|---|
| Report date: | 10-22-2012 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| ENS 48221 | 10 CFR 50.72(b)(2)(xi), Notification to Government Agency or News Release, 10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation, 10 CFR 50.72(b)(3)(iv)(A), System Actuation |
| 2892012004R00 - NRC Website | |
operating condensate booster pump tripped. A secondary pump "counting circuit" relay stuck in the energized position when the number of operating condensate booster pumps was reduced to one booster pump, CO-P-2C. The remaining condensate booster pump tripped when one of the two operating condensate pumps was secured. The FW & Condensate pump counter circuits help ensure there are enough pumps running to support the pumps downstream of them.
During the reactor trip, all rods fully inserted in the required time and all safety systems responded as expected. The highest RCS pressure reached was 2334 psig. Two main steam safety valves lifted during the transient within the desired setpoints and properly seated again following the lifts. RCS pressure did not reach the Power Operated Relief Valve (PORV) setpoint.
While the control room team was implementing the emergency operating procedure during the transient a control room operator identified that CO-P-2C was tripped with the control switch in the red flag / operating position. The control room operator matched flags to the green flag / stopped position on the pump at 8:02:05, which cleared the auto-start condition of CO-P-2A and CO-P-2B and tripped FW-P-1B per counting circuit design on loss of condensate booster pumps.
Engineering and Maintenance identified that a counting circuit relay CO-P-2/52X58 was stuck in the energized position and was the cause of the booster pumps tripping and the subsequent reactor trip.
The design of the pump counting circuit allows for one latent failure as long as pumps in the circuit are not changing state. Plant process computer alarm L2716 came in during the event identifying that there was a mismatch between redundant relay pairs and appeared as a low level plant process computer alarm. This alarm came in prior to securing the condensate pump CO-P-1A and was acknowledged.
However, the importance of addressing the mismatched relay when the alarm comes in has never been reflected in operating or alarm response procedures.
A four (4) hour NRC Event Notification was required by 10 CFR 50.72(b)(2)(iv)(B), for an actuation of the Reactor Protection System (RPS) when the reactor was critical; also under 10 CFR 50.72(b)(2)(xi), due to an information release to local officials. The event was also reported under 10 CFR 50.72(b)(3)(iv)(A) and 10 CFR 50.72(b)(3)(iv)(B), due to a valid actuation of the Emergency Feedwater System. The ENS notification (EN 48221) was completed on Wednesday August 22, 2012 at 11:32 EDT. Therefore this LER is being submitted pursuant to the requirements of 10 CFR 50.73(a)(2)(iv)(A) and 10 CFR 50.73(a)(2)(iv)(B).
mismatch alarm design not being adequately communicated through operating procedures and alarm responses to mitigate single logic failure vulnerabilities.
A contributing cause was determined to be relay CO-P-2/52X58 that was installed in T1R19 stuck in the energized position. Another contributing cause was determined to be PPC Alarm L2716 "Cond/Booster/FP Interlock Ckt" was prioritized as a low level alarm - Level 3 Alarm.
C. ANALYSIS / SAFETY SIGNIFICANCE
There were no resulting personnel, off site radiological, or environmental safety issues caused by this event.
There were several consequences of relay CO-P-2/52X58 sticking in the energized position. The primary consequence was that when condensate pump CO-P-1A was secured, condensate booster pump CO-P-2C tripped. As anticipated, the auto start feature on backup condensate booster pumps CO- P-2A and CO-P-2B performed an auto-start, but CO-P-2/52X58 subsequently tripped them. This auto start and auto trip continued for a minute, resulting in multiple starts from each pump. This required testing during the shutdown to assess equipment condition. Suction to the main feedwater pumps was reduced and produced a loss of feedwater (LOFW) event. This LOFW caused reactor coolant system (RCS) pressure to rise and the Reactor Protection System (RPS) to actuate on high pressure, initiating a reactor trip.
An additional consequence of the CO-P-2/52X58 sticking was that the operating main feedwater pump FW-P-1B did not trip on loss of condensate booster pumps due to the CC)-P-2/52X58 relay sticking in the energized position. This prevented the Anticipatory Reactor Trip System (ARTS) from actuating and tripping the reactor on loss of both main feedwater pumps. FW-P-1B not tripping also prevented emergency feedwater (EFW) from actuating on loss of both feedwater pumps. EFW automatically actuated on low steam generator level (
D. CORRECTIVE ACTIONS
Corrective Actions Completed:
- Investigated cause of CO-P-2C tripping and discovered CO-P-2/52X58 stuck in the energized position.
- CO-P-2/52X58 relay was replaced and successfully tested in outage T1M07 (Fall 2012).
- PPC alarm L2716 was prioritized as Level 2 and an Operations brief was provided to SROs informing them of the potential impacts of a relay failure in the counting circuit.
Corrective Actions Planned:
- Procedures will be modified to ensure that Counting Circuit Mismatch Alarm L2716 is clear before starting up or shutting down pumps that affect the counting circuit.
- The alarm priority of L2716 will be permanently changed.
J * Energy Industry Identification System (EllS), System Identification (SI) and Component Function Identification (CFI) Codes are included in brackets, [SI/CFI] where applicable, as required by 10 CFR 50/3 (b)(2)(ii)(F).