05000412/LER-2002-002
| Beaver Valley Power Station Unit No. 2 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4122002002R00 - NRC Website | |
FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)
PLANT AND SYSTEM IDENTIFICATION
Westinghouse-Pressurized Water Reactor System (PWR) Emergency Diesel Generator (EK)
CONDITIONS PRIOR TO OCCURRENCE
Unit 2: Mode 6 at 0 % power The 2-2 emergency diesel generator was being removed from service at the start of the event in preparation to support its scheduled refueling outage maintenance activities. There were no other systems, structures, or components that were inoperable at the start of the event that contributed to the event.
DESCRIPTION OF EVENT
On February 14, 2002, during the 2R09 refueling outage at Beaver Valley Power Station (BVPS) Unit 2, clearance tags were being hung to remove the 2-2 emergency diesel generator (EDG) from service in preparation to support scheduled refueling outage maintenance activities. The 2-2 EDG is part of the "B" train equipment and was not required to be operable per Technical Specifications.
This clearance for the 2-2 EDG had been modified approximately five days prior to its posting, to include additional electrical isolation. This revision added clearance tags for the potential transformer (PT) fuses and other locations which the prior clearance had not addressed. During the clearance revision, a typographical error resulted in one set of PT fuses for the 2-1 EDG being added to the clearance instead of for the 2-2 EDG. This error was not discovered during the review process. The PT fuses were removed by opening the PT circuit panel for the 2-1 EDG at 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br /> (hrs) on February 14 as directed by the clearance work order. This action disabled the 2-1 EDG output breaker, making the EDG inoperable ("A" train protected equipment) because the EDG would not automatically load after starting. During the time that the PT fuses were removed on the 2-1 EDG, core alterations including core reload had been occurring. BVPS Unit 2 transitioned from Mode 6 to Mode 5 at 1743 hrs on February 18. During this subject period, there were no challenges to the offsite power sources, and core cooling was maintained.
Subsequently, during the restoration of the 2-2 EDG to operation, it was discovered at 1815 hrs on February 18, that the wrong PT fuses (i.e., 2-1 EDG fuses) had been previously removed. The 2-1 EDG was immediately declared inoperable. The PT fuses were re-installed in the 2-1 EDG and the 2-1 EDG was declared operable at 1830 hrs. A test run was then completed on this EDG to prove its operability.
With the PT fuses removed, the 2-1 EDG would have started upon a station loss of offsite power and accelerated to proper speed and output voltage. However, the output breaker would not have FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3) automatically closed and the EDG would not have automatically supplied emergency AC power to the BVPS Unit 2 "A" train emergency bus. Without the ability to automatically supply power to the "A" train emergency bus, the 2-1 EDG did not meet Technical Specification requirements for an operable EDG in Modes 5 and 6, and therefore was inoperable. During the time that the PT fuses Technical Specification 3/4.8.1.2 requirements regarding onsite emergency AC power generation.
During most of this subject period, the 2-2 EDG could not have been started due to the scheduled maintenance activities being performed on it.
CAUSE OF EVENT
This event occurred due to three causes: 1) Shutdown safety process weakness, 2) Outage clearance process weakness, and 3) expectations for clearance review and approval were not clearly understood nor consistently reinforced.
The shutdown safety process was not effective in providing definitions and training to protect the Engineered Safeguards Features (ESF) equipment of the protected train. Although protected train shutdown safety signs had been placed on the doors leading to the AE Emergency Switchgear area, the plant operator who removed the 2-1 EDG PT fuses did not view the posted shutdown safety signs as a barrier to his entry. He proceeded into the area to perform an authorized activity believing he was exempt from the shutdown safety sign. The control and location of the shutdown safety signs is not clearly defined or understood. The shutdown safety program failed to heighten the individual's awareness or prevent him from freely accessing the protected area.
Six distinct barriers within the clearance process failed to prevent a human error from propagating through the process and resulting in the loss of automatic ESF equipment operability. These included preparation of the clearance, two separate operator reviews of the clearance, another operator's release of the clearance, the operators posting of the clearance, and the maintenance walkdown of the clearance. Some outage planning activities were not complete prior to the beginning of the outage and led to an increased clearance preparation and modification workload during the outage. As a result of this additional work effort, inattention to details, inadequate planning, excessive number of clearance revisions, time pressure, and inadequate reviews all contributed to this event. Each of these factors helped break through the defense in depth design that were in place for the clearance process.
Expectations for clearance review and approval were not clearly understood and reinforced.
Additionally it was noted that trust in others influenced a document's extent of review. In each of the first two causes, the individuals did not meet written expectations. The failure to meet expectations appears to be a common thread through the activities leading to this event.
FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)
REPORTABILITY
BVPS Unit 2 Technical Specification 3.8.1.2.b requires one EDG be operable in Modes 5 and 6.
During the time that the PT fuses were removed from the 2-1 EDG, the 2-1 EDG was being credited to fulfill the BVPS Unit 2 Technical Specification 3/4.8.1.2 which requires one EDG to be operable in Modes 5 and 6. Without the ability to automatically supply power to the "A" train emergency bus, the 2-1 EDG could not meet Technical Specification surveillance 4.8.1.2 requirements for an operable EDG in Modes 5 and 6, and therefore, was inoperable. The 2-2 EDG was inoperable since it was on clearance for scheduled maintenance, which left no operable EDG. The Action statement for Technical Specification 3.8.1.2 requires that core alterations be immediately suspended with less than one EDG operable. Core alterations were not suspended during the time with less than one EDG operable (because 2-1 EDG was not recognized to be inoperable). Therefore, this was a condition prohibited by the plant's Technical Specifications and is reportable pursuant to 10 CFR 50.73(a)(2)(i)(B).
SAFETY IMPLICATIONS
During the time frame when the 2-1 EDG had its PT fuses removed, BVPS Unit 2 had each of its two emergency busses being fed by its normal independent offsite power line. In addition, the Station Blackout (SBO) electrical cross-tie to BVPS Unit 1 was available. [BVPS Unit 1 was operating at 100% during this time frame.] If needed, the SBO cross-tie can connect a Unit 1 emergency bus with a Unit 2 emergency bus.
With the PT fuses removed, the 2-1 EDG would have started upon a station loss of offsite power and accelerated to proper speed and output voltage. However, the output breaker would not have automatically closed and the EDG would not have automatically supplied emergency AC power to the BVPS Unit 2 "A" train emergency bus. If a total loss of offsite power had occurred, initially there would have been no automatically-supplied AC power from any onsite AC power generation source to the BVPS Unit 2 emergency busses. Control room indications powered from onsite safety-related batteries would have been available. Control room operators would have been able to confirm from the control room that the "A" train EDG (2-1) was running at rated speed. A BVPS Unit 2 EDG could satisfactorily run for nearly two hours, unloaded and without Service Water flow. Following station procedures, operations personnel would have attempted to locally close the "A" train EDG output breaker. The EDG output breaker would have closed, the EDG sequencer would then have been automatically energized, and the required emergency loads would have been automatically sequenced on to the "A" train emergency bus. It is conservatively estimated that this action would have been completed within approximately 20-30 minutes.
The time to core boiling during the time when the PT fuses were removed varied from 72 minutes to 1205 minutes. Thus, onsite emergency AC power would have been restored by locally closing the EDG output breaker before the Reactor Coolant System (RCS) reached saturation conditions if a loss of offsite power had occurred. In addition, the SBO electrical cross-tie to connect Unit 2 with a FACILITY NAME (1) PAGE (3) LER NUMBER (6) DOCKET (2) Unit 1 emergency bus was available and could have been implemented within 60 minutes. Should the RCS have reached saturation conditions, water sources were available to provide make-up to the RCS and an adequate vent path was available.
Although fuel movement was occurring during this time period, containment closure is not required in the event of a postulated design basis fuel handling event since the fuel being moved was not recently irradiated. However, if a design basis handling event had occurred during this time period, containment closure was possible within approximately 30 minutes without electrical power.
Although the BVPS Unit 2 Technical Specifications require that an operable EDG in Modes 5 and 6 be capable of automatically energizing and loading its associated emergency bus, the EDG sequencer and automatic loading capability is not relied upon in the safety analyses for BVPS Unit 2.
An EDG could be manually started and loaded as necessary and still meet the safety analyses assumptions and requirements necessary for those design basis accidents and events which are licensed for BVPS Unit 2 in Modes 5 and 6. Therefore, though the 2-1 EDG was not operable during the time frame from February 14 —18, it was capable of functioning and would have been used by plant operators following plant procedures to mitigate any credible event.
The Residual Heat Removal (RHR) System pumps, which were being used to remove core decay heat during this time frame, are designed to be automatically stripped off of an emergency bus prior to the EDG sequencer automatically loading emergency components onto the emergency bus in any mode of operation. Thus, the RHR pumps would have to be manually loaded onto an emergency bus, if the EDG sequencer was actuated to function.
BVPS Unit 2 does not have a shutdown Probabilistic Risk Assessment (PRA) model. However, an evaluation was conducted for this event and the Core Damage Probability (CDP) for this event was determined to be significantly less than 1E-06. Therefore, the event was not risk significant.
Based on the above, the safety significance of this event was small.
CORRECTIVE ACTIONS
1. The shutdown safety process is being strengthened. This includes implementing a "No-Tag" lockout of protected train equipment, additional criteria when a clearance is revised, and revised pre-job and pre-posting briefing cards to reflect protected train.
2. Changes are being implemented in the clearance process. These include the use of standard clearances, changes to the clearance tracking program, and improvements for clearance approvals.
3. Expectations for review and approval of clearances are being reinforced.
U.S. NUCLEAR REGULATORY COMMISSION 4. Additional training is being implemented for Section Holders and Work Order Holders. Further training needs are being evaluated.
Completion of the above and other corrective actions are being tracked through the corrective action program.
PREVIOUS SIMILAR EVENTS
A review of past Licensee Event Reports for both BVPS Unit 1 and Unit 2 found one similar event involving inadequate clearance or shutdown safety related activities within the last five years:
BVPS Unit 1 LER 01-004, "Manual Reactor Trip Due to Loss of Station Instrument Air"