05000400/LER-2004-005
| Docket Number Sequential Revmonth Day Year Year Month Day Year N/Anumber No. 05000 | |
| Event date: | 10-18-2004 |
|---|---|
| Report date: | 12-17-2004 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| ENS 41129 | 10 CFR 50.72(b)(3)(iv)(A), System Actuation |
| 4002004005R00 - NRC Website | |
I. DESCRIPTION OF EVENT
On October 18, 2004, the plant was in a refueling outage (Mode 5) with the Reactor Coolant System (RCS) [AB] depressurized and pressurizer [PZR] water level at approximately 50%. The 'A' Residual Heat Removal (RHR) train was providing shutdown cooling, and the 'B' RHR train was operable but not in service. Maintenance Surveillance Test MST-E0045, "6.9 KV Emergency Bus 1A-SA and 1B-SB Under Voltage Relay Channel Calibration" was in progress on Emergency Bus 1A-SA [EB]. This test requires the lifting of leads from multiple terminals. The 'B' safety train ('B' Residual Heat Removal [BP], 'B' Emergency Service Water [BI], 'B' Component Cooling Water [CC], and 'B' 6.9 KV Emergency Bus 1B-SB [EB]) was being maintained as the "protected" train.
At 0741, Emergency Bus 1A-SA lost power when its power supply breaker (Breaker 105) [BKR] unexpectedly opened. When power was lost to Bus 1A-SA, its associated loads, including the 'A' RHR pump, were also de-energized. The 'A' Emergency Diesel Generator (EDG) [DG] automatically started and re-energized the bus as designed, and the 'A' Safeguard Sequencer [JE] initiated loading of the bus.
All loads sequenced as expected except the 'A' Emergency Service Water (ESW) pump and the 6.9 KV power supply breaker from Bus 1A-SA to 480V Bus 1A3-SA [ED]. Bus 1A3-SA provides power to various safety-related load centers and support system loads. The operations staff responded to the event in accordance with applicable plant procedures and restarted the 'A' RHR pump at 0745. RCS temperature rose from approximately 116 degrees to 122 degrees Fahrenheit during the 4 minute, 39 second interval in which the 'A' RHR pump flow was interrupted. Bus 1A3-SA was manually re- energized at 1029 and the 'A' ESW pump was manually started at 1054. As previously noted, the 'B' safety train equipment was being maintained as the protected train, and thus the 'B' RHR train remained operable throughout the event. Component Cooling Water (CCW) remained functional in support of both RHR loops throughout the event. Also, the 'B' Charging/Safety Injection [BQ] pump was operable.
Post-event analysis showed that two of the leads lifted for MST-E0045 inadvertently came into contact with each other. This resulted in Bus 1A-SA's undervoltage (UV) [86] relay being energized, the opening of the normal power supply breaker (Breaker 105) to Bus 1A-SA, and the automatic start and loading of the 'A' EDG.
The cause of 'A' ESW pump and Bus 1A3-SA not sequencing as expected is well understood. During the brief period (approximately 79 seconds) that the 86 UV relay was not reset, contacts in the 'A' ESW pump breaker functioned as designed, and prevented the breaker from receiving a close signal from the sequencer. By the time the 86 UV device reset, the sequencer was no longer sending the ESW pump a start signal. Also, during the time that the 86 UV relay was not reset, contacts in the feeder breaker to Bus 1A3-SA functioned as designed and sent a trip signal to the breaker. When the EDG output breaker to Bus 1A-SA closed, the power supply breaker to Bus 1A3-SA received a close signal. However, since the breaker was also receiving a trip signal from the 86 UV relay, it closed and immediately tripped and locked out, as designed, due to anti-pumping logic. In summary, the plant responded as designed when the two lifted leads inadvertently came into contact with each other.
Energy Industry Identification System (EIIS) codes are identified in the text within brackets [ ]. There are no commitments included in this report.
II. CAUSE OF EVENT
The loss of power to Emergency Bus 1A-SA was caused by ineffective taping of leads that were lifted to support the undervoltage relay channel calibration that was in progress on Bus 1A-SA. The lifted leads were not wrapped in accordance with plant standards, but rather a single piece of electrical tape was folded over the lead ends. In the warm cabinet environment, the tape lifted away and exposed the leads.
Two leads came into contact, resulting in a bus undervoltage relay actuation on Bus 1A-SA. This actuation resulted in the normal power supply breaker to the bus opening, and subsequently an automatic start of the 'A' EDG.
Post-event analysis showed that the station's outage risk management practices contributed to the brief loss of RHR flow for shutdown cooling. Specifically, the Harris Plant utilizes a protected train approach to manage risk during outage activities. As previously discussed, the 'B' safety train was the protected train at the time of this event; however, the 'A' RHR pump was in service providing shutdown cooling flow. Thus, plant conditions existed in which shutdown cooling flow would be lost if the unprotected train (bus) was lost. Station risk management was primarily focused on protecting the equipment in the 'B' safety train, not on protecting against the unplanned interruption of shutdown cooling flow. The station's risk management program accepted that operator action to restore an interruption in shutdown cooling met the intent of protecting key safety functions.
III. SAFETY SIGNIFICANCE
Actual Safety Consequences:
There were no safety significant consequences as a result of this event. Automatic starting and loading of an EDG and temporary loss of shutdown cooling are analyzed for the Harris Plant and are described in the FSAR. The plant is designed for both of these events and it responded as designed for given conditions. RCS temperature rose approximately 6 degrees to 122 degrees Fahrenheit, which is well below when bulk boiling could occur. Analysis showed that the projected time to boiling was 70.43 minutes. The operations staff responded to the event in accordance with plant procedures and promptly restored 'A' RHR flow for shutdown cooling. The 'B' safety train equipment remained operable throughout the event. Also, the 'B' Charging/Safety Injection pump was operable. CCW remained functional in support of both RHR loops throughout the event.
Potential Safety Consequences:
The potential safety consequences under alternate conditions are bounded by plant design. As noted above, analysis showed that the projected time to boiling was 70.43 minutes. The most credible alternate condition is the loss of both RHR trains. This alternate condition could have resulted had control room operators not taken action in accordance with plant procedures. If the operators had not successfully restarted the 'A' RHR pump and also failed to start the operable and protected 'B' RHR pump, procedure guidance (AOP-020, Loss of RCS Inventory or Residual Heat Removal While Shutdown) would have directed the operators to pursue restoration of shutdown cooling by restoring operation of an RHR train, while exercising alternatives to reestablish core cooling and preparations to mitigate the affects of core boiling. In Mode 5, the alternatives include cooling via feeding and steaming through the steam generators, starting containment fan coolers, and using the charging system to maintain RCS inventory should boil-off occur. Therefore, no significant safety consequences exist under alternate scenarios that would place the plant in a condition beyond its design bases.
This report is submitted pursuant to 10 CFR 50.73(a)(2)(iv)(A) for the automatic actuation of 'A' EDG.
IV. CORRECTIVE ACTIONS
Power to Emergency Bus 1A-SA was re-established via automatic starting and loading of 'A' EDG.
Control room operators restored 'A' RHR pump flow for shutdown cooling in 4 minutes and 39 seconds.
A Maintenance "stand-down" was conducted to discuss the event and reinforce expectations associated with proper taping practices for lifted leads. A thorough review of RFO-12 scheduled activities was conducted to identify activities that may challenge key safety functions. The lessons learned from this event and additional guidance pertaining to the reliance on non-protected train equipment to support key safety functions were provided to Operations personnel. Also, Maintenance training lesson plans are being revised to include instruction on the taping of lifted leads.
Several corrective actions are being taken to improve the station's risk management practices. For example, Outage Management Procedure OMP-003, "Outage Shutdown Risk Management" is being revised to incorporate restrictions which ensure that when only one train of shutdown cooling is operating, the operating train is protected. Also, OMP-003 and Work Coordination Manual Procedure WCM-001, "On-Line Maintenance Risk Management", are being revised to specify which key safety functions can be provided by plant equipment in a non-active "standby" status.
V. PREVIOUS SIMILAR EVENTS
NRC Inspection Reports 2003010 and 2003008 (dated January 26, 2004 and June 3, 2003 respectively) On April 28, 2003, testing was being conducted in accordance with OST-1813, "Remote Shutdown System Operability 18 Month Interval Modes 5, 6, or Defueled." During this testing, CCW surge tank level was observed to be decreasing. The operators entered Abnormal Operating Procedure AOP-014, "Loss of Component Cooling Water", and both CCW pumps were secured when surge tank level dropped below 4%. Securing the CCW pumps stopped CCW flow to the RHR heat exchangers. The non-essential CCW header was isolated, the 'B' CCW pump was restarted, and RHR temperature control was re-established with the 'B' RHR train. During the approximately 5 minute period in which CCW flow was secured, RCS average temperature increased 4.7 degrees Fahrenheit. The loss of component cooling water inventory resulted from the lifting of a CCW relief valve. This relief valve was found to have improper relief valve nozzle ring settings which resulted in it remaining open longer than designed. This event was determined to be of very low safety significance. The NRC issued a Green Non-cited Violation for failure to follow 10 CFR 50, Appendix B, Criterion XVI in that corrective actions from a similar previous event in 1991 (LER 91-016) did not preclude repetition of a loss of CCW. The root causes identified for the 2003 event are not the same as those identified for the event that is the subject of this LER. Thus, the 2003 event is not significant in relation to the subject event.
A review of corrective action program data for the last five years identified no previous similar events resulting from improper taping of lifted leads. Also, there were no similar events over the last decade involving the loss of power to an emergency bus and/or automatic starting of an emergency diesel generator that are significant in relation to the event that is the subject of this LER.