05000368/LER-2013-001
| Arkansas Nuclear One - Unit 2 | |
| Event date: | 01-02-2013 |
|---|---|
| Report date: | 02-21-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 3682013001R00 - NRC Website | |
A. Plant Status At the time of the subject event, Arkansas Nuclear One Unit-2 (ANO-2) was at approximately 100% power. All structures, systems, and components that were needed to mitigate, reduce the consequences of, or limit the safety implications of the event were available.
B. Event Description
On January 02, 2013 at approximately 1308 CST, ANO-2 experienced an invalid Safety Injection Actuation Signal (SIAS) [BP][BQ], Containment Isolation Actuation Signal (CIAS) [JM], and Containment Cooling Actuation Signal (CCAS) [BK] while technicians were performing Plant Protection System (PPS)[JC] matrix testing.
The ANO-2 PPS contains an Engineered Safety Features Actuation System (ESFAS) [JE] which initiates the appropriate Engineered Safety Features (ESF) system response whenever conditions or variables deviate from a pre-selected operating range. In order to respond to analyzed accidents, the ESFAS monitors a number of parameters essential to accident recognition and mitigation. Each parameter has four independent measuring devices which input to the four protective channels A, B, C and D. In order for a trip demand (actuation of an ESF function) to be considered valid by the PPS, it must simultaneously occur on two or more channels. The signal from the input devices are applied to ESFAS coincidence logic matrix ladders. These six (6) logic matrix ladders are designed to account for all possible "two out of four" combinations of the monitoring channels. The six matrices are designated AB, BC, BD, AC, CD and AD.
At the time of the subject event, technicians were testing the CD Matrix utilizing the CD Matrix test switch [JE][HS]. When the test switch was cycled during the CD Matrix trip functional surveillance in accordance with an authorized testing procedure, a CIAS, SIAS and CCAS was received, resulting in the auto start of the Emergency Diesel Generators (EDG) [EK], High Pressure Safety Injection (HPSI) Pumps [BQ][P] and Low Pressure Safety Injection (LPSI) Pumps [BP][P] in the standby mode, and the re-positioning of numerous safety related components to their actuated state. The SIAS initially aligned boric acid injection into the Reactor Coolant System (RCS)[AC] as designed, and resulted in a reactor power decrease to approximately 87%.
All components operated as designed for a CIAS, SIAS, and CCAS. Following the diagnosis of the inadvertent actuations, the operating crew entered the Abnormal Operating Procedures (A0Ps) for inadvertent SIAS and inadvertent CIAS, and took actions to mitigate the actuations in accordance with approved plant procedures. Major mitigating actions in the inadvertent CIAS AOP included overriding the CIAS to restore Component Cooling Water (CCW) [CC] to the Reactor Coolant Pumps (RCP) [AB] [P] to prevent RCP seal damage. The inadvertent CIAS AOP directs restoration of CCW to the RCPs within ten minutes; otherwise the reactor must be manually tripped and all RCPs secured. The operating crew restored CCW to the RCPs within six minutes of the CIAS. Components actuated by the invalid CCAS do not require urgent action; therefore no inadvertent CCAS AOP is required.
Major mitigating actions in the inadvertent SIAS AOP to minimize the plant transient included overriding and aligning Service Water (SW) [BI] to Auxiliary Cooling Water (ACW) and CCW, and securing the injection of boric acid from the Boric Acid Makeup Tanks [CB][TK] by securing the Charging Pumps [CB][P] and Boric Acid Makeup Pumps [CB][P] to prevent further unnecessary power reduction. The HPSI and LPSI Pumps were placed in pull-to-lock to minimize pump overheating on minimum recirculation flow. The inadvertent SIAS AOP directs that if SIAS cannot be reset within one hour, operators are to restart the HPSI, LPSI, and Boric Acid Pumps, and trip the reactor. The inadvertent actuation signals were reset and the HPSI and LPSI Pumps were returned to standby within the required one hour time clock. The EDGs which were auto-started by the invalid SIAS, ran unloaded for a period of time, and were subsequently synchronized to their respective buses and loaded one at a time for oil burn-off purposes as recommended by the vendor. Notification to the NRC was performed in accordance with 10CFR50.72 reporting requirements on January 02, 2013 at 1742 CST (Event Notification 48644). ANO-2 returned to full power operation at approximately 2042 CST the same day.
C. Event Cause A failure modes analysis determined that the direct cause of the event was the degradation of a PPS matrix test switch, with the Root Cause determined to be failure to implement a preventative maintenance (PM) strategy for the switch during a 1986 modification. This allowed the test switch to exceed the vendor specification of 10,000 cycles of operation. Since installation in 1986, the matrix test switch has been cycled more than 11,800 times to satisfy Technical Specification surveillances. The accumulated wear from exceeding the lifecycle limit resulted in internal degradation which during testing, resulted in full SIAS/CCAS/CIAS actuations. The 1986 modification package identified the limited number of cycles of operation for the test switch; however, the package failed to implement a replacement PM. The subject matrix test switch is a Grayhill Model 8620 switch which was originally custom-ordered by Combustion Engineering.
A contributing cause of the event was determined to be a lack of guidance for cleaning of the test drawer. The matrix test module is an enclosed drawer in the PPS cabinet that requires removal of four screws to access the internals. The cabinet cleaning Work Order does not contain instruction to access the test panel for cleaning. In addition, it was identified during the course of the investigation that the performance of the cleaning Work Order has become less rigorous, resulting in additional dust accumulation in the cabinet, which increased the dust entering the test drawer. The lack of adequate cleaning PMs allowed dust and debris to accumulate on the exterior of the switch and then migrated into the switch internals.
D. Corrective Actions
The CD Matrix test switch was replaced. Replacement of the remaining matrix test switches is scheduled for the next refueling outage and a replacement PM strategy is planned for the matrix test switches. Revisions to the PPS testing procedures are planned prior to any future testing that would involve manipulation of the PPS Matrix test switches. The planned procedure revisions documented in the Root Cause Evaluation include an enhanced verification of available matrix relay light indications when manipulating the PPS Matrix test switches, and a caution or limitation to initiate a CR to replace a matrix test switch if it feels spongy, detent is not noticeable, or exhibits other aberrant behavior. Additionally, revisions to Work Tasks that facilitate equipment cabinet cleaning are planned for certain identified systems to include the test or maintenance portions of the systems.
E. Safety Significance Evaluation The operating crew entered AOPs for inadvertent SIAS and inadvertent CIAS and stabilized plant power at approximately 87%. All components operated as designed for an SIAS, CCAS and CIAS. All actions taken by the operating crew were in accordance with approved plant procedures. The operating crew verified the SIAS, CIAS and CCAS actuations were not valid by verifying that pressurizer pressure and containment pressure had not exceeded the setpoints for these actuations. The inadvertent SIAS AOP directs operators to override and restore SW to ACW and CCW, and to place all HPSI and LPSI pumps in pull-to-lock. The procedure invokes a one-hour time clock to reset the SIAS; otherwise, the HPSI and LPSI pumps must be restarted and the reactor manually tripped. While having the HPSI and LPSI pumps in pull-to-lock results in a prevented safety function as described in 10CFR 50.73(a)(2)(v), in the event of an actual emergency condition, all Emergency Operating Procedures (EOPs) that would be entered as a result of an actual SIAS demand contain steps to verify that Safety Injection components actuate properly. Contingency actions in these EOPs would direct the operators to start the available HPSI and LPSI pumps (take them out of pull-to-lock). Steps are also included in the applicable EOPs to verify that SW pressure is maintained above 85 psig. If SW pressure cannot be maintained above 85 psig, then the EOPs direct the operators to re-isolate ACW and CCW from the SW system.
Based on the short duration of the subject event and the fact that AOP and EOP procedures prescribed appropriate operator actions to restore equipment for required accident mitigation during an actual event, the overall impact on nuclear safety is considered to be minimal. This assessment was confirmed with a probabilistic risk analysis which evaluated the short time period (approximately 40 minutes) that the HPSI and LPSI pumps were in pull-to-lock.
Additionally, the subject event did not pose any significant radiological or industrial safety risk to plant personnel and had no adverse impact to the health and safety of the general public.
10CFR 50.73(a)(2)(iv)(A): Any event or condition that resulted in manual or automatic actuation of any of the systems listed in paragraph (a)(2)(iv)(B).
Applicable systems in 10CFR 50.73(a)(2)(iv)(B):
(2) General containment isolation signals affecting containment isolation valves in more than one system (3) Emergency core cooling systems for pressurized water reactors including: high-head, intermediate-head, and low-head injection systems and the low pressure injection function of residual (decay) heat removal systems (7) Containment heat removal and depressurization systems, including containment spray and fan cooler systems (8) Emergency AC electrical power systems including emergency diesel generators 10CFR 50.73(a)(2)(v) Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:
(B) Remove residual heat (D) Mitigate the consequences of an accident
G. Additional Information
10CFR 50.73(b)(5) states that this report shall contain reference to "any previous similar events at the same plant that are known to the licensee." NUREG-1022 reporting guidance states that term "previous occurrences" should include previous events or conditions that involved the same underlying concern or reason as this event, such as the same root cause, failure, or sequence of events.
A review of the ANO corrective action program and Licensee Event Reports for the previous three years revealed no relevant similar events.
Energy Industry Identification System (EllS) codes and component codes are identified in the text of this report as p0q.