05000333/LER-2008-003
| James A. Fitzpatrick Nuclear Power Plant | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| ENS 44546 | 10 CFR 50.72(b)(3)(iv)(A), System Actuation |
| 3332008003R00 - NRC Website | |
BACKGROUND
Emergency Bus [EIIS=BU] 10600 is one of two (2) redundant 4160 VAC emergency buses that supply power to loads which are essential for plant safety. Emergency Bus 10600 is normally powered by 4160 VAC Electrical Bus 10400 [EIIS=BU] through bus tie circuit breaker [EllS=52], 71-10404. Electrical Bus 10400 receives power from either Normal Station Service Transformer [EIIS=XFMR], 71-T4, through circuit breaker [EllS=52], 71-10402 or from Reserve Station Service Transformer [EIIS=XFMR], 71-T2, through circuit breaker [EIIS=52], 71-10412.
At the time of the event, Emergency Bus 10600 was powered by Bus 10400 through circuit breaker 71-10404, Bus 10400 was powered by Reserve Station Service Transformer, 71-T2, through circuit breaker 71-10412, and functional testing was being conducted on circuit breaker 71-10402 trip and lock-out relay [EIIS=86], 71-86-1HOND01.
Upon receipt of a trip signal, trip and lockout relay 71-86-1HOND01, isolates Bus 10400 by opening circuit breakers 71-10402 and 71-10404. Opening circuit breaker 71-10404 isolates the Emergency Bus 10600 from Bus 10400, thereby de-energizing Emergency Bus 10600 in preparation for the "B" Division Emergency Diesel Generators [EllS=DG] (EDG) starting and supplying power to the 10600 emergency bus. The "B" and "D" EDG(s) make up the "B" Division EDG subsystem.
EVENT DESCRIPTION
On October 7, 2008 at 0635, while the James A. FitzPatrick Nuclear Power Plant (JAF) was in Cold Shutdown (Mode 4), trip and lockout relay 71-86-1HONDO1 was manually actuated in accordance with a preventative maintenance functional test work order resulting in the de-energization of 4160 VAC Emergency Bus 10600.
Emergency Bus 10600 is one of two (2) redundant emergency buses that supply power to loads which are essential for plant safety. Permission was granted to begin, functional testing on trip and lockout relay, 71-86-1HOND01, while Emergency Bus 10600 was energized from Bus 10400 through circuit breaker 71-10404. The actuation of trip and lockout relay 71-86-1HONDO1 caused circuit breaker 71-10404 to open, thereby disconnecting the electrical power source that was providing power to Emergency Bus 10600.
The loss of power to Emergency Bus 10600 bus resulted in automatic actuation of the "B" and "D" Emergency Diesel Generators (EDG). The generators started, paralleled and aligned to provide power to Emergency Bus 10600 as designed. The loss of power to Emergency Bus 10600 resulted in a loss of power to the "B" Reactor Protection System (RPS) thereby causing a half scram signal and a Primary Containment Isolation System (PCIS) Group 2 actuation. The PCIS Group 2 actuation closed containment isolation valves in multiple systems including Residual Heat Removal (RHR) shutdown cooling (SDC), Reactor Water Clean-Up system, "B" side Reactor Building Ventilation system and "B" Drywell Containment Atmosphere Monitoring (CAM) system supply and return. In addition, the "B" train Standby Gas Treatment (SGT) system auto-initiated and the Uninterruptable Power Supply (UPS) Motor Generator (MG) set transferred to DC drive in response to the loss of AC power. The operating RHR pump that was supplying SDC was de-energized with the loss of power to Emergency Bus 10600 and the SDC system isolated as part of the PCIS Group 2 isolation.
In response to the event, all plant systems responded as designed and expected. Trip and lockout relay, 71-86-1HOND01, was reset to restore power to Emergency Bus 10600. SDC was restarted at 0705 and RHR Service Water (RHRSW) was restored at 0713, in accordance with plant abnormal operating procedures.
The event was reported to the NRC Operations Center via the Emergency Notification System (EN# 44546) pursuant to 10 CFR50.72(b)(3)(iv) for EDG actuation and containment isolation affecting multiple systems (8-hour report).
The event requires written NRC notification within sixty (60) days in accordance with 10CFR50.73(a)(2)(iv)(A), "Any event or condition that resulted in manual or automatic actuation of ...(B)(2) General containment isolation signals affecting containment isolation valves in more than one system", and "...(B)(8) Emergency AC electrical power systems, including emergency diesel generators".
EVENT ANALYSIS
The affected 4160 VAC Emergency Bus, 10600, is one of two (2) redundant 4160 VAC emergency buses that supply power to loads which are essential for plant safety. During the event, the redundant 4160 VAC Emergency Bus (10500) and the associated loads remained operable. Both emergency buses are independently capable of providing requisite power to essential plant loads that are necessary for safe shutdown and accident mitigation. The Emergency Power System remained capable of providing power to the plant for all design basis accidents throughout the course of the event.
The loss of normal power to Emergency Bus 10600 resulted in automatic actuation of the "B" and "D" EDG(s). The generators started, paralleled and aligned to provide power to Emergency Bus 10600 as designed. The loss of power to Emergency Bus 10600 resulted in a loss of power to the "B" Reactor Protection System (RPS) thereby causing a half (1/2) scram signal and a Primary Containment Isolation System (PCIS) Group 2 actuation. The PCIS Group 2 actuation closed containment isolation valves in multiple systems including Residual Heat Removal (RHR) shutdown cooling (SDC), Reactor Water Clean-Up system, "B" side Reactor Building Ventilation system and "B" Drywell Containment Atmosphere Monitoring (CAM) system supply and return. In addition, the "B" train Standby Gas Treatment (SGT) system auto-initiated and the Uninterruptable Power Supply (UPS) Motor Generator (MG) set transferred to DC drive in response to the loss of AC power.
During the event, the operating RHR pump tripped and the SDC common suction line isolated. However, there were two (2) RHR pumps powered from the redundant Emergency Bus 10500 available and the SDC suction isolation valves were capable of being opened manually as required by the plant Technical Specifications. As such, the SDC Mode of RHR remained operable throughout the event. The SDC was restarted within 33 minutes. During this time, Reactor Coolant temperature increased 6° F.
There were no system or component failures that occurred as a result of this event. Barriers providing safety to the public were not compromised during this event and the safety significance was minimal.
CAUSE OF EVENT
The cause of the event was the re-scheduling of a trip and lockout relay functional test outside of the bus outage work window without performing a risk assessment review. The trip and lockout relay functional test was re-scheduled from within a bus outage work window due to the unavailability of DC power to the lockout relay coil as a result of concurrent work being conducted on 345 KV Main Transformers [EIIS=XMFR], 71T-1A and 71T-1B. The trip and lockout functional test work package was prepared for implementation during the bus outage and did not identify adequate precautionary measures for conducting the functional test outside the bus outage work window.
Per plant procedure, AP-10.09, Maintaining Risk Assessment, a review for impact on key safety functions is required when an outage activity is re-scheduled from within an approved system outage work window. Though the outage schedulers were recently counseled on the importance of performing a risk assessment for emergent work, they were not as cognizant of the requirement to perform a risk assessment on outage work activities re-scheduled outside an approved system outage work window. As a result, a plant risk assessment review was not performed and the functional test was allowed to proceed with Emergency Bus 10600 energized by Bus 10400 through bus tie connection circuit breaker, 71-10404. Manually actuating trip and lockout relay, 71-86-1HOND01, opened circuit breaker 71-10404, thereby causing Emergency Bus 10600 to de-energize.
EXTENT.OF CONDITION The inadvertent actuation of plant safety system(s) as a result of re-scheduling the trip and lockout relay functional test without ensuring the performance of a risk assessment review was limited to the scope of the functional test and did not affect redundant plant systems, trains or components. .
ASSESSMENT OF SAFETY CONSEQUENCES
There were no nuclear, radiological or safety consequences associated with the event. During the time that normal power to Emergency Bus 10600 was lost, the plant was in Cold Shutdown mode (Mode 4) and the redundant Emergency Bus 10500 and associated loads were operable. The time to boil was approximately twenty (20) hours.
While the RHR pump that was aligned for SDC tripped when the 10600 Emergency Bus de-energized, the SDC system remained operable throughout the event. SDC was restarted at 0705 and the RHRSW pump was restored at 0713. At the time of the event, the plant was preparing for a change to the Hot Standby mode (Mode 3). The effectiveness of plant barriers providing safety to the public was maintained and the safety significance of this event is considered low.
CORRECTIVE ACTIONS
Immediate Corrective Actions:
1.Immediately reset trip and lockout relay 71-86-1HONDO in order to restore normal power to Emergency Bus 10600.
2.Restored SDC within thirty (30) minutes following initiation of the event.
3.Restored RHRSW within thirty-eight (38) minutes following initiation of the event.
4. Staffed the Work Control Center with Senior Reactor Operators (SRO) to facilitate an additional level of review' prior to work authorization.
Completed Corrective Actions
1.Performed a Level 1 Human Performance Error Review (HPER) 2.Performed a Root Cause Analysis 3.Reinforced management expectations for control of protected equipment and work authorization release reviews.
4.Briefed Maintenance Supervisors on their responsibility to understand and communicate job scope and plant impact when requesting work authorization.
Planned Corrective Actions:
1.Expand the scope of the briefing requirements and develop guidance in plant procedures to include discussions on schedule changes involving system window logic, coding activities affecting key safety functions and risk assessments following outage schedule updates.
2.Review model work orders for related breaker trip and lockout relay tests to ensure that required bus outage and breaker position prerequisites are included.
3.This event will be shared with the industry through the INPO OE Program.
FAILED COMPONENT IDENTIFICATION
There were no component failures as a result of this event.
SIMILAR EVENTS
LER-2008-001 / CR-JAF-02997 On September 16, 2008 at 0734, with the plant shutdown and in the refueling mode (Mode 5), a fuse was removed during an equipment tag-out evolution resulting in the closure of two Primary Containment Isolation System (PCIS) valves and a loss of Shutdown Cooling (SDC). The cause of the event was ineffective implementation of the outage risk assessment procedure.
REFERENCES
JAF Condition Report CR-JAF-2008-03805, "Loss of Emergency Bus (10600) and Auto-Start of Train "B" EDG Due To Work Task Schedule Error".