05000440/LER-2009-002, For Perry Nuclear Plant, Regarding Diesel Generator CO2 Fire Suppression Control Panel Miswiring Results in an Unanalyzed Condition
| ML092380146 | |
| Person / Time | |
|---|---|
| Site: | Perry  |
| Issue date: | 08/20/2009 |
| From: | Bezilla M FirstEnergy Nuclear Operating Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-09-212 LER 09-002-00 | |
| Download: ML092380146 (6) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii) 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4402009002R00 - NRC Website | |
text
FENOC FirstEnergy Nuclear Operating Company Perry Nuclear Power Station 10 Center Road Perry, Ohio 44081 Mark B. Bezilla Vice President 440-280-5382 Fax: 440-280-8029 August 20, 2009 L-09-212 10 CFR 50.73(a)(2)(ii)(B)
ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001
SUBJECT:
Perry Nuclear Power Plant Docket No. 50-440, License No. NPF-58 Licensee Event Report Submittal Enclosed is Licensee Event Report (LER) 2009-002, "Diesel Generator C02 Fire Suppression Control Panel Miswiring Results in an Unanalyzed Condition." There are no regulatory commitments contained in this submittal.
If there are any questions or if additional information is required, please contact Mr. Robert Coad, Manager - Regulatory Compliance, at (440) 280-5328.
Enclosure:
LER 2009-002 cc:
NRC Project Manager NRC Resident Inspector NRC Region III A4~p
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150-0104 EXPIRES 8/31/2010 (9-2007)
, the NRC may (See reverse for required number of not conduct or sponsor, and a person is not required to respond to, the digits/characters for each block) information collection.
- 3. PAGE Perry Nuclear Power Plant 05000440 1 OF 5
- 4. TITLE Diesel Generator C02 Fire Suppression Control Panel Miswiring Results in an Unanalyzed Condition
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED SEQUENTIALI REV FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR NUMBER NO.
MONTH DAY YEAR 06 22 2009 2009 002
- - 00 08 20 2009 FACIUTY NAME DOCKET NUMBER
- 9. OPERATING MODE
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)
El 20.2201(b)
[L 20.2203(a)(3)(i)
El 50.73(a)(2)(i)(C)
[] 50.73(a)(2)(vii) 1
[] 20.2201(d)
LI 20.2203(a)(3)(ii)
E] 50.73(a)(2)(ii)(a)
E] 50.73(a)(2)(viii)(A)
E] 20.2203(a)(1)
E] 20.2203(a)(4)
Z 50.73(a)(2)(ii)(B)
[: 50.73(a)(2)(viii)(B)
[] 20.2203(a)(2)(i)
E] 50.36(c)(1)(i)(A)
[E 50.73(a)(2)(iii)
El 50.73(a)(2)(ix)(A)
- 10. POWER LEVEL LI 20.2203(a)(2)(ii)
LI 50.36(c)(1)(ii)(A)
[] 50.73(a)(2)(iv)(A)
LI 50.73(a)(2)(x)
LI 20.2203(a)(2)(iii)
LI 50.36(c)(2)
E] 50.73(a)(2)(v)(A)
LI 73.71 (a)(4) 100 LI 20.2203(a)(2)(iv)
E] 50.46(a)(3)(ii)
[] 50.73(a)(2)(v)(B)
LI 73.71(a)(5)
E] 20.2203(a)(2)(v)
EL 50.73(a)(2)(i)(A)
LI 50.73(a)(2)(v)(C)
LI OTHER Specify in Abstract below SLI 20.2203(a)(2)(vi)
LI 50.73(a)(2)(i)(B)
LI 50.73(a)(2)(v)(D) or in
CAUSE OF EVENT
The root cause was determined to be an inadequate post modification test which failed to identify the miswiring of two output wires from the diesel generator C02 Fire Suppression System control panel. The specific failure mechanism in this event was the mislabeling and subsequent mislanding of two output wires from the diesel generator C02 Fire Suppression System control panels. The mislanding of the two wires impacted the Division 2 and Division 3 diesel generators. This condition should have been identified by the post modification testing and, corrected prior to returning the equipment to service. It was determined that the post maintenance/modification testing requirements do not require sufficient rigor to assure system functionality prior to returning equipment/systems to service. A contributing cause was a less than adequate cable tag/wire mark configuration control process that led to the mislabeling and eventual mislanding of the two output wires.
EVENT ANALYSIS
All 3 diesel generator CO2 Fire Suppression System control panels were replaced in December of 2008 under an engineering modification. The replacement of the obsolete C02 fire protection panels was created to enhance reliability of the C02 systems and minimize the possibility of inadvertent C02 releases. The modification replaced the three sets of circuit boards with two new redundant panel control units, each capable of independently controlling each of the three systems separately. This was to maintain separate control of each system without disabling all three systems if a problem develops in a control unit.
On June 22, 2009, engineers identified a period of time where a C02 Fire Suppression System wiring issue would have affected the Division 2 and Division 3 diesel generator ventilation supply fans. The issue was identified in the corrective action program on June 22 and was reviewed by the Senior Reactor Operator (SRO) on June 23, 2009. The SRO comments state that the wiring issue has been corrected in the plant and does not currently challenge operability of the Division 2 or 3 diesel generators.
The fire protection safe shutdown analysis requires the operation of one of the two HVAC fans in each divisional diesel generator room for support of the emergency diesel generator operation to achieve and maintain safe shutdown in the event of a plant fire. The SRO stated that if neither ventilation fan was able to be started, this could make the Division 2 diesel generator inoperable and requested a past operability review to determine if the Division 2 diesel generator was made inoperable during the testing performed. The reportability review was due at 1500 on June 30, 2009. At the time this event was determined to be reportable, the plant was at 100 percent power.
Over the duration of the miswiring condition, the plant was in every MODE 1-5, as well as defueled.
From February 23, 2009, until May 13, 2009, the plant was in a refueling outage.
The time period during which the diesel generators were affected by the wiring error began on January 15, 2009, with the completion of post modification testing and the relanding of all the lifted leads on the terminals of the new C02 Fire Suppression System control panels following a design modification, and ended on June 23, 2009, when the wiring error was corrected. In the discovered wiring configuration, a fire protection C02 actuation signal for the Division 3 diesel generator room would cause the Division 2 diesel generator room ventilation supply fans to isolate. Additionally, a
fire protection C02 actuation signal for the Division 2 diesel generator room would cause the Division 3 diesel generator room ventilation supply fans toisolate. During troubleshooting, it was identified that this condition existed whether the C02 Fire Suppression System control panels were in 'normal' (automatic) or 'lockout.' The identified wiring configuration did not affect Division 1 diesel generator. Additionally, over the duration of the miswiring condition, there were active fire impairments to perform an hourly fire watch of the affected diesel generator rooms.
Later during the root cause investigation, it was determined that the Division 2 diesel generator was inoperable for approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 52 minutes during the February 4, 2009, testing when a Division 3 C02 actuation signal was given a trip signal to the Division 2 diesel generator ventilation supply fans. During this period of time, the Division 1 diesel generator was operable.
A bounding probabilistic risk assessment was performed for the time period the miswiring condition existed between January 15, 2009, and June 23, 2009. For this condition, the probabilistic risk assessment calculated a change in Core Damage Frequency (CDF) to be 4.41 E-07. The Large Early Release Frequency (LERF) is on the order of 1.OE-08. Configurations with changes in CDF of less than 1.OE-06 and a LERF of less than 1.OE-07 are not considered to be significant risk events. Based on the probabilistic risk assessment results, this condition is considered to be of low
safety significance
CORRECTIVE ACTIONS
The two Division 2 and Division 3 C02 Fire Suppression System control panel wiring label errors were corrected and the wires relanded to their correct terminals.
Procedure guidance will be revised to provide more detailed expectations concerning the scope and rigor of post maintenance/modification testing requirements. Additionally, the cable tag/wire mark configuration control process guidance and wiring verification requirements will be enhanced.
The Operations Superintendent will review with all licensed SROs the importance of safety system functional testing when maintenance or modifications have been performed on portions of the system.
Corrective actions will track satisfactory completion of the Division 1, 2, and 3 diesel generators C02 Fire Suppression System Detection/Operability Testing.
PREVIOUS SIMILAR EVENTS
- A search of Licensee Event Reports and the corrective action program over the past 3 years at the Perry Nuclear Power Plant found two similar events had been reported.
LER 2006-001 reported a condition of an internal wiring jumper on a switch in the remote shutdown panel that was found to be installed incorrectly. The jumper was identified as a result of surveillance testing. The switch contact has the function of isolating control room circuitry from the remote shutdown panel circuitry for the Reactor Core Isolation Cooling (RCIC) system turbine exhaust valve. Complete isolation of the control room circuitry for the RCIC valve would not have been established by transferring control switches to the emergency position. The cause of the condition was determined to be a wiring drawing error made during manufacture of the panel that
resulted in the switch being incorrectly wired. The cause of the wiring error was determined to be a less than adequate vendor drawing review that failed to discover a drawing error on a wiring diagram and less than adequate testing.
Initial corrective actions consisted of correcting the miswired jumper in the remote shutdown panel and contacting the vendor's Engineering Manager, and informing him of the drawing error and the wiring error in the vendor supplied remote shutdown panel. Further corrective actions included revising remote shutdown surveillances to include testing to verify correct isolation and transfer functions of the Normal/Emergency switches in the remote shutdown panel to ensure the circuits meet the unique testing requirements for double isolation of the Fire Protection Program, and revising the Updated Safety Analysis Report to clarify information that was difficult to locate and information that conflicted with the Supplement to the Safety Evaluation Report (SSER). Corrective actions from LER 2006-001 could not reasonably be expected to have prevented the condition documented in LER 2009-002.
LER.2006-003 reported a condition on May 2, 2006, while performing research for a calculation revision, it was discovered that one circuit of the Division 1 Emergency Diesel Generator (EDG)
Control Room Pull-To-Lock (PTL) Control Switch was not designed to isolate the Control Room from the local Division 1 EDG controls in the event of a Control Room fire. At 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br /> on May 4, 2006, with the plant in Mode 1 at 100 percent power, it was determined that this condition violated the Perry Nuclear Power Plant Fire Protection Program and could adversely affect plant shutdown in the case of a control room fire. A potential fire induced hot short in the diesel generator logic circuit could have resulted in a spurious trip of the diesel generator, even if control was transferred to local control. This condition has existed since 1989. Interim actions in the form of procedure changes have been completed to address this issue. A final resolution to the issue was a design change to incorporate Appendix R Control Room isolation features to the diesel generator pull-to-lock control switch circuit. Corrective actions from LER 2006-003 could not reasonably be expected to have prevented the condition documented in LER 2009-002.
COMMITMENTS
There are no regulatory commitments contained in this report. Actions described in this document represent intended or planned actions, are described for the NRC's information, and are not regulatory commitments.PRINTED ON RECYCLED PAPERPRINTED ON RECYCLED PAPER