05000293/LER-2013-001
| Pilgrim Nuclear Power Station (Pnps) | |
| Event date: | 1-10-2013 |
|---|---|
| Report date: | 3-7-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 2932013001R00 - NRC Website | |
BACKGROUND
The Pilgrim Station Boiling Water Reactor design includes a recirculation system that provides the drive flow of water to the jet pumps within the reactor vessel. The Recirculation System includes two loops. Each loop is located inside primary containment and is external to the reactor vessel. Each external loop contains one variable-speed, motor-driven recirculation pump and two motor operated valves, one on the suction side and one on the discharge side of the pump. The pump motor is powered by the generator portion of the respective motor-generator (MG) set. The reactor recirculation system cools the reactor core with forced water flow (forced convection).
The Residual Heat Removal (RHR) System consists of pumps, piping, and valves that provide flow paths through heat exchangers to remove post-operation energy from the nuclear system. The RHR System is designed to permit cooling of both the Drywell and the Torus which provide a heat sink for the Automatic Depressurization System (ADS), High Pressure Coolant Injection System (HPCI) and Reactor Core Isolation Cooling (RCIC) System under normal and accident conditions. The RHR System is normally aligned to the Low Pressure Coolant Injection (LPCI) mode. This mode provides a Core Standby Cooling System (CSCS) function.
Although this event involved the tripping of the recirculation pumps, it was during the performance of a Logic System Functional Test within the LPCI portion of the RHR System that caused the trip signal. This test is designed to demonstrate the RHR pressure permissive loop selection logic functions as designed. The LPCI Loop Selection Logic instrumentation is required to detect a ruptured recirculation loop and to automatically select the unbroken recirculation loop for injection into the reactor vessel. This Logic System Functional Test is a Technical Specification requirement.
Test switches and jacks are utilized and relays are manually actuated to allow simulating a Loss of Coolant Accident (LOCA), in order to test the LPCI initiation and control, and loop selection logic. The only portion of the LPCI loop selection logic circuitry which cannot be tested during plant operation, is the recirculation pump trip portion.
On January 10, 2013, Technical Specification testing via surveillance procedure 8.M.2-2.10.2-9 "RHR System Reactor Pressure Permissive Loop Selection Logic Functional Test' was performed. The purpose of this testing is to demonstrate a portion of the reactor low pressure permissive logic associated with LPCI Loop A & B.
EVENT DESCRIPTION
On Thursday, January 10, 2013 at 1534 hour0.0178 days <br />0.426 hours <br />0.00254 weeks <br />5.83687e-4 months <br /> [EST], with the reactor at 100% core thermal power, both reactor recirculation pumps unexpectedly tripped and a manual reactor scram was inserted as required by station procedures. Following the reactor scram, all rods were verified to be fully inserted and the Primary Containment Isolation System Group II (Reactor Building) and Group VI (Reactor Water Cleanup System) actuations occurred as designed due to the expected reactor water level shrink associated with the scram signal. All other plant systems responded as designed. The scram was uncomplicated and decay heat was released to the main condenser via the turbine by-pass valves.
The cause of the two reactor recirculation pumps tripping was due to the inadvertent seal-in of a break detection relay in the Low Pressure Coolant Injection (LPCI) Loop Select Logic circuitry within the Residual Heat Removal (RHR) System during surveillance testing. When the logic was reset at completion of testing, a normally open relay contact (which was inadvertently closed during test restoration) interlocked with the recirculation pumps circuit, and sent a trip signal to the drive motor breakers.
As part of the LPCI Loop Select Logic Test, several General Electric HGA break detection relay covers were removed to allow the technicians to actuate and verify relays. As testing continued with no discrepancies, various break detection relays status/ states were verified in accordance with the procedure.
While performing the surveillance, the technicians manually actuated break detection relay 10A-K10513, requested Operations to depress the "LPCI Loop Select Reset Push Buttons" (10A-S1B and 10A-S1A), and verified the various associated relays in the circuit were de-energized. This was done several times in accordance with the procedure which verifies that the LPCI Loop A & B logic has been reset. Among the relays that were verified to be de-energized was break detection relay 10A-K1056 (cover was still removed) and the relay was found to be de-energized.
In preparation of "Returning to Normal", the technicians replaced the covers on the relays. Some difficulty was encountered with three of the relays including relay 10A-K10513 which took multiple attempts and required the help of the 2nd technician in the back of the panel. This technician aided by compressing the retaining clips so that the cover would not get caught on the outside of the clips. The technicians finished replacing all the relay covers.
The technicians were unaware that the action of installing the relay cover on relay 10A-K1056 disturbed (i.e.; bumped) the relay armature such that 10A-K10513 contact 1-7 closed and sealed-in the 10A-K105B relay in the energized state. With 10A-K10513 unknowingly energized, the technicians continued with the procedure to restore other logic functions. The technicians then placed the "RHR Break Detection Test Reset" keylock switch (10A-546) to the "RESET" position. This action de-energized break detection relay 10A-K10413 and closed its related contact 1-2 which re-activated the recirculation pump trip circuit correctly in accordance with the procedure. However, the inadvertently energized and sealed-in 10A-K1056 relay combined with the 10A-K10413 relay contact 1-2 now being closed on reset (as designed), energized another break detection relay within the reactor recirculation pump trip circuit, 10A-K29B, which in turn tripped Recirculation Motor Generator Set A& B drive motor breakers as per the design of the system logic.
CAUSE
The Direct Cause of this event was the inadvertent seal-in of break detection relay 10A-K10513.
This relay was inadvertently energized during the process of relay cover re-installation. When the 10A-K104B relay was reset via key-lock switch 10A-S46, power was applied to the LPCI recirculation pump trip relay, 10A- K29B, which then tripped both Recirculation Motor Generator Set drive motor breakers.
The Root Cause of this event was that I&C Department personnel failed to ensure adequate barriers were established to mitigate potential adverse consequences. Specifically, the surveillance procedure did not contain steps to remove and re-install relay covers. The correct placement of these steps would have ensured relay state verification following cover installation and prior to resetting the logic. In this case, the known and long standing problem with difficulties experienced during relay cover installation was not addressed effectively. A tool was developed to install problematic covers, but the procedure was not reviewed and modified with sufficient detail to ensure a successful outcome.
A Human Performance Error Review (HPER) Level 1 was performed. The initial investigation validated that relay 10A-K105B sealed in while the cover was being re-installed. The relay cover installation was performed after the relay status check but before the final logic circuit reset. Since the relay was sealed-in without being noticed, a trip signal to the subject drive motor breakers was initiated when the logic was reset.
CORRECTIVE ACTIONS
The following immediate corrective actions were completed.
- PNPS Procedure 8.M.2-2.10.2-9 "RHR System Reactor Pressure Permissive Loop Selection Logic Functional Test" was revised with steps to reinstall relay covers and added a verifier to check relay status prior to logic circuit resets. This is a Corrective Action to Preclude Recurrence (CAPR).
- Initiated a Training Evaluation and Action Request (TEAR) for training on relay cover installation and the concerns with contact initiation which covers this event and basic sensitivity of these relays.
The following procedure improvements are planned:
- Revise all critical maintenance I&C and electrical procedures to include steps to remove / replace relay covers and post-installation verification of relay configuration. (CAPR)
- I&C and Electrical Lab procedures are being prioritized for revision based on their schedule date. The reviews will be completed by a lead technician or engineer. A second review by a supervisor will be performed prior to issuing the procedure.
- Identify trip sensitive or positional components that should be identified or protected.
- Ensure physical work is complete prior to resetting any logic i.e. relay covers on, drawers pushed in, jumpers and lifted leads removed or landed, etc.
- Critical steps will be identified in accordance with existing station procedures and the reason for the critical step will be identified.
The corrective actions above and additional corrective actions are addressed in the Corrective Action Program.
SAFETY CONSEQUENCES
The event occurred during normal power operation while at 100 percent core thermal power with the reactor mode switch in the "RUN" position and steady state conditions.
There were no component or system failures that caused this event.
This event posed no threat to public health and safety.
The plant response to the two recirculation pump trip followed the expected response from the plant analysis as described in the FSAR. The two recirculation pump trip is a non limiting transient considered in the station design as described in the Abnormal Operational Transients, Nuclear Safety Operation Analysis, and the Initial Core Station Safety Analysis sections of the FSAR.
This event is analyzed in the FSAR and does not challenge safety limits or fission product barriers. Core power was maintained within design limits. All other Engineered Safeguard System functions were operable during this event.
The conditional core damage probability of this event was calculated to be approximately 2E-7 which is low when compared to the risk significant threshold of 1E-6.
REPORTABILITY
This report is submitted in accordance with 10 CFR 50.73(a)(2)(iv)(A) — Any event or condition that resulted in manual or automatic actuation of any system listed in paragraph 10 CFR 50.73 (a)(2)(iv)(B). The Reactor Protection System (RPS) including: reactor scram or trip is included in 10 CFR 50.73 (a)(2)(iv)(B).
PREVIOUS EVENTS
A review for similarity was conducted of Pilgrim Station Licensee Event Reports (LERs) submitted to the NRC.
The review focused on LERs involving a similar trip or cause involving both recirculation MG sets/pumps. The review identified no similar event.
ENERGY INDUSTRY IDENTIFICATION SYSTEM (EllS) CODES:
SYSTEMS
CODES
None N/A
REFERENCES
Condition Report, CR-PNP-2013-0147 — Both recirculation pumps spuriously tripped and a manual reactor scram was inserted as required by station procedures.