05000425/LER-2010-002
| Vogtle Electric Generating Plant - Unit 2 | |
| Event date: | 01-28-2010 |
|---|---|
| Report date: | 10-12-2010 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 4252010002R00 - NRC Website | |
A. REQUIREMENT FOR REPORT
The Vogtle Electric Generating Plant (VEGP) Emergency Core Cooling System (ECCS) consists of three subsystems: centrifugal charging (high head), safety injection (intermediate head) and residual heat removal (low head). Each of the three subsystems consist of two 100 percent capacity trains that are interconnected and redundant such that either train is capable of supplying 100 percent of the required flow to mitigate the accident consequences. Technical Specification 3.5.2 requires two trains of ECCS to be Operable in Modes I -3, but allows for one or more trains to be removed from service for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> provided the flow equivalent of one train of ECCS is maintained. Each train includes the piping, instruments and controls to ensure an Operable flow path capable of taking suction from the Reactor Water Storage Tank (RWST) upon a Safety Injection (SI) signal and automatically transferring suction to the containment sump. On January 28, 2010 with centrifugal charging pump (CCP) 2A [BQ] tagged out of service for maintenance, the 2B SSPS [JG] Mode Selector switch was placed in Test to perform a surveillance test on the 2B reactor trip breaker. Placing the 2B SSPS Mode Selector switch in Test defeats the Engineered Safety Features (ESF) automatic actuation signal to the 2B train components. Thus when the 2B SSPS Mode Selector switch was placed in test, the automatic actuation signal that would start CCP 2B was defeated. Since CCP 2A was tagged out of service for maintenance and CCP 2B would not have automatically started on an SI signal, both trains of ECCS were rendered Inoperable. Therefore this condition is reportable pursuant to:
10CFR50.73(a)(2)(v)(D), "Any event or condition that could have prevented the fulfillment of the safety functiodof structures or systems that are needed to mitigate the consequences of an accident.
B. UNIT STATUS AT TIME OF EVENT
At the time of the event on January 28, 2010 Unit 2 was operating in Mode I at 100 percent rated thermal power. There was no other inoperable equipment except for that described herein that contributed to this event.
C. DESCRIPTION OF EVENT
On August 23, 2010 during a review by an Operations Superintendent of past performances of the reactor trip breaker under voltage and shunt trip surveillance test procedures it was discovered that on January 28, 2010 the surveillance test had been performed on the 2B reactor trip breaker with Centrifugal Charging Pump (CCP) 2A tagged out of service for planned maintenance.
Performance of the 2B reactor trip breaker surveillance test requires that the 2B SSPS Mode Selector switch be placed in Test. Placing the 2B SSPS Mode Selector switch in Test removes 120 VAC power to the slave relays housed inside the cabinet. This action defeats the automatic ESF actuation signals to the affected equipment on that train. Operability of a centrifugal charging subsystem in accordance with Technical Specification 3.5.2 includes the � piping, instrumentation and controls necessary to ensure the required accident analyses ECCS flow is delivered upon receipt of a SI signal. When the 2B SSPS Mode Selector switch was placed in Test on January 28, 2010 at 09:21 hours, the automatic start capability of CCP 2B in response to an SI signal was defeated rendering the 2B centrifugal charging subsystem Inoperable per Technical Specification 3.5.2. Additionally, since the 2A CCP had been previously tagged out of service for planned maintenance on January 27, 2010 at 04:00 hours and rendered incapable of automatically starting, the unit was operated in a condition prohibited by Technical Specification 3.5.2 until the 2B SSPS was returned to normal standby alignment on January 28, 2010 at 11:50 hours. Once 2B SSPS was retumed to normal standby alignment, the 2B train centrifugal charging subsystem was Operable which brought the ECCS into compliance with Technical Specification 3.5.2 Condition A.
D. CAUSE OF EVENT
An apparent cause determination (ACD) was performed on this event. The cause of this event was due to an inadequate Loss of Safety Function (LOSF) determination, as described in Technical Specification 5.5.15, being performed and the work planning process not adequately identifying potential Technical Specification implications for the scheduled work. This resulted in both activities being scheduled and performed concurrently. A contributing factor to this event was the fact that the surveillance for the 2B reactor trip breaker had been delayed for a few weeks due to emergent plant issues. As a result, the surveillance test was scheduled to be performed in an A train work week. The normal scheduling process used at VEGP is to designate a gjven week as either an A train or B train work week. For the week of January 25 through January 29, 2010 the week was designated as an A train work week. In accordance with plant procedures, typically only A train components would be subject to maintenance or surveillance testing during an A train work week. However, exceptions to this are allowed provided an Operations Superintendent authorizes the work after ensuring no Technical Specification conflicts or significant increase in CDF and LERF exist. This review is required by Technical Specification 5.5.15, Safety Function Determination Program. The Safety Function Determination Program as described in Technical Specification 5.5.15, prompts the user to perform cross train checks to ensure the loss of a capability to perform the safety function credited in the accident analyses does not go undetected. This requirement is included, and is further elaborated on, in the plant procedure that implements the Safety Function Determination Program. For this event, the Operations Shift Supervisor incorrectly concluded the performance of the 2B reactor trip breaker surveillance test with the 2A CCP tagged out of service, would not result in a loss of safety system function. It was also determined that the on shift Operations personnel have an over reliance on the scheduling process for identifying when a loss of safety function exists, the plant procedures that implement the safety function determination program are not detailed on the types of activities that require a loss of safety function determination and the results of the determination are not formally documented.
E. ANALYSIS OF EVENT
The Vogtle Electric Generating Plant (VEGP) Emergency Core Cooling System (ECCS) consists of three subsystems: centrifugal charging (high head), safety injection (intermediate head) and residual heat removal (low head). Each of the three subsystems consist of two 100 percent capacity trains that are interconnected and redundant such that either train is capable of supplying 100 percent of the required flow to mitigate the accident consequences. Each train includes the piping, instruments, and controls to ensure an operable flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to the containment sump.
With the centrifugal charging subsystem 2A out of service for planned maintenance and thus rendered inoperable in accordance with Technical Specification 3.5.2, the 2B SSPS Mode Selector switch was placed in Test to allow performance of a surveillance test on the 2B reactor trip breaker. When the 2B SSPS Mode Selector switch was placed in Test, all of the automatic actuation signals processed through 2B SSPS were defeated. Consequently, the 2B centrifugal charging subsystem was rendered inoperable in accordance with Technical Specification 3.5.2, since it would not have automatically started for cold leg injection upon receipt of an SI signal.
Therefore, this event represents a loss of safety system function. However, based on a risk assessment of this condition for the relatively short period of time the configuration existed (approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />), the increase in core damage frequency (CDF) and large early release frequency (LERF) were found to be low. Additionally, there were no events which required an ECCS actuation during the time the configuration existed. Based on these considerations, there was no adverse affect on plant safety or on the health and safety of the public.
F. CORRECTIVE ACTIONS
1. Programmatic changes to the methodology currently employed to perform LOSF determinations are being developed. These programmatic changes will require a more rigorous approach for performing and documenting LOSF determinations and will include Operator aids to assist personnel in making the correct determination. Additionally, a change plan has been developed to ensure the necessary procedures are revised, appropriate personnel are made cognizant of the programmatic changes and management's expectations for performing and documenting the LOSF determinations. The expected completion date for this corrective action is November 18, 2010.
2. As an interim corrective action until the programmatic changes are implemented, Operations management issued a shift briefing to licensed personnel describing this event with emphasis on the application of Technical Specification 3.0.6 and Technical Specification 5.5.15 for performing loss of safety function evaluations.
� 3. This event is being covered in the next segment of Licensed Operator Requalification (LORQ) and will include discussions on the application of Technical Specifications 3.0.6 and 5.5.15 for performing loss of safety function determinations. The expected completion date for this corrective action is November 1, 2010. Additionally, LOSF training will be provided to licensed operators on a reoccurring basis to demonstrate proper LOSF determination techniques and examples. This training will include classroom and simulator exercises to ensure proficiency and understanding of TS Limiting Condition for Operation (LCO) 3.0.6, TS LCO 3.0.3, and TS 5.5.15 . G. ADDITIONAL INFORMATION 1. Failed Components:
None 2. Previous Similar Event:
which resulted in a loss of safety function. In both of these cases the work planning process failed to identify the loss of safety function, Operations had an over reliance on the work planning process and inadequate loss of safety function determinations were performed.
3. Energy Industry Identification System Codes:
High Pressure Injection System-[BQ] Solid State Protection System-[JG] _NRC FORM 386A (9-2007) PRINTED ON RECYCLED PAPER)