05000390/LER-2008-001, Automatic Safety Injection Actuation Blocked in Modes 4 and 3
| ML081400794 | |
| Person / Time | |
|---|---|
| Site: | Watts Bar  |
| Issue date: | 05/19/2008 |
| From: | Skaggs M Tennessee Valley Authority |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| LER 08-001-00 | |
| Download: ML081400794 (10) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown |
| 3902008001R00 - NRC Website | |
text
May 19, 2008 10 CFR 50.73 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C. 20555 Gentlemen:
In the Matter of
)
Docket No. 50-390 Tennessee Valley Authority
)
WATTS BAR NUCLEAR PLANT (WBN) UNIT 1 - LICENSEE EVENT REPORT 390/2008-001, REVISION 0 - AUTOMATIC SAFETY INJECTION (SI) ACTUATION INSTRUMENTATION BLOCKED IN MODES 4 AND 3 This submittal provides LER 390/2008-001. This LER documents an event where both trains of automatic SI actuation instrumentation were blocked in Modes 4 and 3. The report regarding this condition is provided in accordance with 10 CFR 50.73(a)(2)(i)(B) and 10 CFR 50.73(a)(2)(v)(D).
There are no regulatory commitments in this letter. If you have any questions concerning this matter, please call Mike Brandon at (423) 365-1824.
Sincerely, Original Signed by M. D. Skaggs Site Vice President Watts Bar Nuclear Plant Enclosure cc: See Page 2
U.S. Nuclear Regulatory Commission Page 2 May 19, 2008 Enclosure cc (Enclosure):
NRC Resident Inspector Watts Bar Nuclear Plant 1260 Nuclear Plant Road Spring City, Tennessee 37381 ATTN: Patrick D. Milano, Project Manager U.S. Nuclear Regulatory Commission Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation MS O8H4 Washington, DC 20555-0001 U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303 Institute of Nuclear Power Operations 700 Galleria Parkway, NW Atlanta, Georgia 30339-5957
E-1 ENCLOSURE LER 2008-001 Automatic Safety Injection Actuation Blocked in Modes 4 and 3
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION (9-2007)
LICENSEE EVENT REPORT (LER)
(See reverse for required number of digits/characters for each block)
APPROVED BY OMB: NO. 3150-0104 EXPIRES: 08/31/2010
, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 1. FACILITY NAME Watts Bar Nuclear Plant
- 2. DOCKET NUMBER 05000 390
- 3. PAGE 1 OF 7
- 4. TITLE Automatic Safety Injection Actuation Blocked in Modes 4 and 3
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED MONTH DAY YEAR YEAR SEQUENTIAL NUMBER REV NO.
MONTH DAY YEAR FACILITY NAME N/A DOCKET NUMBER N/A 03 20 2008 2008 0
05 19 2008 FACILITY NAME N/A DOCKET NUMBER N/A
- 9. OPERATING MODE 3
- 10. POWER LEVEL 0%
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply) 20.2201(b) 20.2203(a)(3)(i) 50.73(a)(2)(i)(C) 50.73(a)(2)(vii) 20.2201(d) 20.2203(a)(3)(ii) 50.73(a)(2)(ii)(A) 50.73(a)(2)(viii)(A) 20.2203(a)(1) 20.2203(a)(4) 50.73(a)(2)(ii)(B) 50.73(a)(2)(viii)(B) 20.2203(a)(2)(i) 50.36(c)(1)(i)(A) 50.73(a)(2)(iii) 50.73(a)(2)(ix)(A) 20.2203(a)(2)(ii) 50.36(c)(1)(ii)(A) 50.73(a)(2)(iv)(A) 50.73(a)(2)(x) 20.2203(a)(2)(iii) 50.36(c)(2) 50.73(a)(2)(v)(A) 73.71(a)(4) 20.2203(a)(2)(iv) 50.46(a)(3)(ii) 50.73(a)(2)(v)(B) 73.71(a)(5) 20.2203(a)(2)(v) 50.73(a)(2)(i)(A) 50.73(a)(2)(v)(C)
OTHER 20.2203(a)(2)(vi) 50.73(a)(2)(i)(B) 50.73(a)(2)(v)(D)
Specify in Abstract below or in II.
DESCRIPTION OF EVENT (continued):
C.
Dates and Approximate Times of Major Occurrences
Date Time (EDT)
Event February 12, 2008 Auto SI block jumper installed in accordance with IMI-99.040.
March 20, 2008 0020 Watts Bar Unit 1 enters Mode 4.
March 21, 2008 0100 Watts Bar Unit 1 enters Mode 3.
March 21, 2008 0913 Plant personnel identified that the Auto SI block jumpers and feedwater Isolation block jumpers remained installed. LCO 3.0.3 was entered.
March 21, 2008 0958 LCO 3.0.3 is initially exited by Operations personnel following the removal of the Auto SI and feedwater isolation jumpers.
March 21, 2008 2133 Licensed Operations personnel determine that the Auto SI function was still blocked and that cycling of reactor trip breakers is required to restore the function. It was also established that the unit remained in LCO 3.0.3 since it was initially entered at 0913.
March 21, 2008 2206 The reactor trip breakers are cycled and LCO 3.0.3 is exited.
D.
Other Systems or Secondary Functions Affected
There are no other systems or secondary functions affected.
E.
Method of Discovery
LCO 3.0.3 was entered on March 21, 2008, at 0913 EDT, after plant personnel identified that the Auto SI block jumpers and feedwater isolation block jumpers had not been removed. The need to cycle the reactor trip breakers to reset the Auto SI function became evident once the pressure and temperature of the unit was raised in Mode 3 to the point the P-11 permissive cleared. At that time, the annunciator window for Auto SI block remained lit due to a relay seal-in contact associated with the Reactor Trip Breakers. From this, the Operations staff (licensed personnel) recognized that the Reactor Trip Breakers had not been cycled to reset the Auto SI function.
II.
DESCRIPTION OF EVENT (continued):
F.
Operator Actions
The Operations staff (licensed personnel) responded to the event by entering Technical Specification (LCO 3.0.3), by requesting removal of the jumpers and by cycling of the reactor trip breakers.
G.
Safety System Responses There were no safety system responses as a result of this condition.
III.
CAUSE OF EVENT
The event discussed in this LER resulted from two key issues:
- 1.
The issues associated with leaving the jumpers installed and entering mode 4 were caused by an inadequate barrier in General Operating (GO) instruction, GO-1, "Unit Startup from Cold Shutdown to Hot Standby," for changing modes. The steps needed for removal of the jumpers were only steps to notify Maintenance personnel to remove the jumpers. This barrier did not provide adequate controls as the step was signed off following the notification/request.
- 2.
The second issue involved the failure to re-enable Auto SI function after the jumpers had been discovered and removed. This shortfall was caused by an inadequate barrier in IMI-99.040. This instruction did not include the steps necessary to properly restore the function.
Based on these factors, the following root causes were identified:
- 1.
GO-1 lacked adequate barriers to ensure the plant was ready to enter Mode 4 or Mode 3. The specific concerns noted include; notify steps in lieu of verifications/sign-off of completion steps, no requirement to document the disposition of discrepancies in checklists, no requirement to track or control jumpers and trip breaker configuration.
- 2.
IMI 99.040 did not require that the trip breakers be closed prior to jumper removal or that the breakers be closed to reset the block logic prior to entering Mode 4.
IV.
ANALYSIS OF THE EVENT
The Background section of the Technical Specification Bases for LCO 3.3.2 clarifies that the outputs from the ESFAS signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients. If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate function best serves to alleviate the condition and restore the unit to a safe condition. The actuation of most ESF components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices.
IV.
Manual and automatic initiation of SI must be OPERABLE in Modes 1, 2, and 3. In these modes, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems.
Manual Initiation is also required in Mode 4 even though automatic actuation is not required. In this Mode, adequate time is available to manually actuate required components in the event of a design basis accident.
However, the automatic actuation logic and actuation relays must be operable in Mode 4 to support system level manual initiation. The jumpers installed under IMI-99.040 block the output of the signals initiated by the SSPS to the actuation relays. This action prevents an automatic safety injection actuation from occurring on the following three inputs:
- 1.
Low pressurizer pressure
- 2.
Low steamline pressure.
- 3.
High containment pressure The installation of the jumpers in this manner maintained the capability for the Operation staff to manually initiate an SI signal at any time during the event.
For WBN, the P-11 permissive allows safety injection actuation on a low pressurizer pressure signal to be manually blocked. This permissive also allows the manual blocking of safety injection and steamline isolation on low steamline pressure. The need to cycle the reactor trip breakers to reset the Auto SI function became evident once the pressure and temperature of the unit was raised in Mode 3 to the point the P-11 permissive cleared. At this time, the annunciator window for Auto SI block remained lit due to a relay seal-in contact associated with the Reactor Trip Breakers. From this, the Operations staff (licensed personnel) recognized that the Reactor Trip Breakers must be cycled to reset the Auto SI function.
Regarding the safety significance of the event, the plant conditions that would have required an Auto SI actuation were not met. If such conditions had occurred, manual initiation was always operable. While the Technical Specifications require the automatic actuation logic and actuation relays be operable in Modes 1-4, the three automatic SI actuation signals, containment high pressure, low pressurizer pressure, and low steam line pressure, are only required to be operable in Modes 1-3, with the latter two only being required once pressurizer pressure has exceeded the P-11 permissive. When the actuation signals are not required the event is not a safety issue, but a Technical Specification compliance issue. In Mode 4 the automatic actuation logic was inoperable due to installation of the jumpers, but, as stated previously, the only required function, manual initiation, was operable. After entry to Mode 3, the time the plant was without Auto SI due to high containment pressure was from 0100 EDT until 2206 EDT on March 21, 2008 (approximately 21 hrs).
The plant was without Auto SI due to the other two actuation signals from 2133 EDT until 2206 EDT (approximately 33 minutes). SI Actuation on high containment pressure is a relatively slow responding signal, unlikely to be quicker than manual actuation. The short period of unavailability of low pressurizer pressure and low steam pressure, together with expected timely manual actuation results in the conclusion that the safety impact of this event is minimal. Regarding the blocking of the feedwater isolation signal, the Technical Specification Bases for LCO 3.3.2 state that an SI signal will initiate a feedwater isolation. As stated previously, manual SI actuation was available and is being credited to limit the overall impact of this event. If required, manual actions (separate from SI actuation) to isolate feedwater may have been taken. Therefore, for the approximately eight hours that feedwater isolation was blocked in Mode 3, timely operator action would have minimized any safety impact from this event.
IV.
As a result of this condition, a review of previous plant startups following the Cycle 6 and 7 outages was performed to establish if the jumpers were removed and the Reactor Trip Breakers cycled during these startups. From the review it was established that the Auto SI function was restored during both unit startups prior to power operations. Based on the available information, evidence supports the conclusion that the jumpers were removed prior to entry into Mode 4. Evidence also supports the conclusion that the Reactor Trip Breakers were cycled within a short time after entry into Mode 4 (but not before entry into Mode 4) and were cycled prior to reaching to the P-11 permissive. The procedural issues discussed above in Section III, Cause of Event, were applicable to the unit startups, but did not impact the reset of the Auto SI function before the P-11 permissive was reached.
V.
ASSESSMENT OF SAFETY CONSEQUENCES
As explained in Section IV, Analysis of the Event, above, plant conditions that could have required Auto SI actuation were not met and manual SI actuation was always available. Based on this, the actual impact to safety from this event is considered minimal.
VI.
CORRECTIVE ACTIONS - The corrective action plan for this condition is being managed within TVA's Corrective Action Program (PERs 140607 and 140641) and therefore, are not considered to be regulatory
commitments
An overview of the corrective action plan is provided below:
A.
Immediate Corrective Actions
- 1.
Upon notification that the jumpers remained installed, the Operations staff (licensed personnel) initiated action to:
a.
Enter LCO 3.0.3.
b.
Remove the jumpers.
c.
Report the event in accordance with 10 CFR 50.72(b)(3)(v)(D).
d.
Document the event in the TVA Corrective Action Program (PERs 140607 and 140641).
B.
Corrective Actions to Prevent Recurrence
- 1.
Revisions will be made to GO-1 along with GO-2, Reactor Startup, and GO-3, Unit Startup from Less Than 4% Reactor Power to 30% Reactor Power, to replace all notify and request steps related to actions that must be completed prior to a mode change with actions that must be verified.
B.
- 2.
IMI-99.040 will be revised to include a requirement to manipulate the Reactor Trip Breakers prior to notifying Operations of the completion of the removal of the jumpers.
- 3.
A jumper tracking program will be developed.
VII.
ADDITIONAL INFORMATION
A.
Failed Components There were no failed components due to this condition.
B.
Previous LERs on Similar Events A review was performed of the previous WBN Licensee Event Reports (LERs) for any events associated with the blocking of the Auto SI function. LER 1997-008 documents a series of events where SI signals were initiated after the Auto SI function had been blocked. However, the issues documented in LER 1997-008 were not related to the installation and removal of the jumpers. The review did not identify any other LERs associated with the Auto SI function.
C.
Additional Information
None.
D.
Safety System Functional Failure This event did involve a safety system functional failure as defined in NEI 99-02, Revision 5.
E.
Loss of Normal Heat Removal Consideration There was no loss of normal heat removal due to this condition.
VIII.
COMMITMENTS
None.