05000440/LER-2010-001

From kanterella
Jump to navigation Jump to search
LER-2010-001, Invalid Isolation Signal Results in Shutdown Cooling Interruption
Docket Number
Event date: 04-27-2009
Report date: 03-25-2010
Reporting criterion: 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat
4402010001R00 - NRC Website

Energy Industry Identification System Codes are identified in the text as [XX].

INTRODUCTION

On April 27, 2009, at 1730 hours0.02 days <br />0.481 hours <br />0.00286 weeks <br />6.58265e-4 months <br />, the Residual Heat Removal (RHR) [BO] shutdown cooling outboard common suction isolation valve 1E12-F008 [ISV] received an invalid isolation signal resulting in the operating RHR A pump [P] tripping while the system was in the shutdown cooling mode of operation. When valve 1E12-F008 isolated, both the A and B RHR subsystems became inoperable and shutdown cooling flow to the reactor from the RHR system was interrupted for approximately one hour and four minutes. At the time of the event, the plant was in MODE 5 (Refueling) with the RHR B subsystem in standby. On April 28, 2009, at 0055 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br />, notification was made to the NRC Operations Center (ENF No. 45025) in accordance with 10 CFR 50.72(b)(3)(v)(B), as an event or condition that could have prevented fulfillment of the safety function of a system needed to remove residual heat.

The event notification was retracted on June 25, 2009, based on further evaluation which determined that interrupted operation of the RHR system in the shutdown cooling mode was not reportable in accordance with 10 CFR 50.72 or 50.73 because (1) there was not a reasonable expectation of the loss of the safety function of a system needed for residual heat removal, and; (2) there was no operation or condition prohibited by the plant's Technical Specifications.

The event was later re-evaluated for reportability using additional guidance and enforcement history related to safety system functional failure reporting. The evaluation determined that the April 27, 2009, loss of shutdown cooling event is reportable as a Licensee Event Report (LER) under 10 CFR 50.73(a)(2)(v)(B), "Any event or condition that could have prevented the fulfillment of the safety function of structures, or systems that are needed to remove residual heat." On March 10, 2010 at 1515 hours0.0175 days <br />0.421 hours <br />0.0025 weeks <br />5.764575e-4 months <br />, the NRC Operations

EVENT DESCRIPTION

On April 27, 2009, at 1730 hours0.02 days <br />0.481 hours <br />0.00286 weeks <br />6.58265e-4 months <br />, with the plant in MODE 5 during refueling outage 12 and water level less than 22 feet 9 inches above the top of the reactor pressure vessel (RPV) flange, the RHR shutdown cooling outboard common suction isolation valve 1E12-F008 received an invalid isolation signal. This caused the RHR A pump to trip while operating in the shutdown cooling mode of operation. RHR A was the primary (operating) RHR subsystem. RHR B was the backup subsystem as required by Technical Specification (TS) Limiting Condition for Operation (LCO) 3.9.9 "Residual Heat Removal (RHR) — Low Water Level." When valve 1E12-F008 isolated, both the A and B RHR subsystems became inoperable. The capability for shutdown cooling subsystem operation was lost with this configuration. The operators entered Off-Normal Instruction (ONI) E12­ 2, "Loss of Decay Heat Removal" and TS LCO 3.9.9, Conditions A and C due to closure of valve 1E12-F008. The operators took the appropriate required actions to comply with the LCO requirements including Required Action A.1, to verify that an alternate method of decay heat removal was available for each inoperable RHR shutdown cooling subsystem; Required Action C.1, to verify reactor coolant circulation by an alternate method; and Required Action C.2, to monitor reactor coolant temperature.

0 At 1735 hours0.0201 days <br />0.482 hours <br />0.00287 weeks <br />6.601675e-4 months <br />, a blown fuse was discovered in control room panel 1H13-P691. The fuse services the circuit that provides 24 vdc electrical power to Trip Unit Card File & Calibration Unit Z1A. When the fuse blew, the 24 vdc electrical power was lost to Trip Unit 1B21-N679A "Reactor Pressure High." Relay 1B21-K124A de-energized, which caused automatic closure of valve 1E12-F008 and the subsequent automatic tripping of the RHR A pump, as designed.

Plant operators pursued parallel paths (both local and remote) to manually realign the valve for RHR B subsystem operation. At 1816 hours0.021 days <br />0.504 hours <br />0.003 weeks <br />6.90988e-4 months <br />, the fuse was replaced. The isolation logic initiated by the blown fuse was reset. Valve 1E12-F008 was aligned manually to the open position from the control room to support RHR B subsystem operation. At 1834 hours0.0212 days <br />0.509 hours <br />0.00303 weeks <br />6.97837e-4 months <br />, the RHR B pump was started to restore shutdown cooling operation in compliance with TS LCO 3.9.9. The amount of time that RHR shutdown cooling was interrupted was one hour and four minutes. During that time, reactor coolant temperature increased three degrees F from 94 to 97 degrees F.

On April 28, 2009, after performing fill and vent activities on the RHR A subsystem, at 0430 hours0.00498 days <br />0.119 hours <br />7.109788e-4 weeks <br />1.63615e-4 months <br />, the RHR A subsystem was declared operable and TS LCO 3.9.9, Condition A was exited. At 0458 hours0.0053 days <br />0.127 hours <br />7.572751e-4 weeks <br />1.74269e-4 months <br />, the RHR A subsystem was started in the normal shutdown cooling lineup and at 0513 hours0.00594 days <br />0.143 hours <br />8.482143e-4 weeks <br />1.951965e-4 months <br />, the RHR B subsystem was placed in standby.

CAUSE OF EVENT

The interruption of RHR shutdown cooling system operation was caused by a blown fuse which sent an isolation signal to valve 1E12-F008. Closure of this valve sent an automatic trip signal to the operating RHR A subsystem and, with the valve now closed, prevented immediate startup of the RHR B pump to restore shutdown cooling.

The fuse blew while Instrumentation and Control (I&C) technicians were installing a jumper in control room panel 1H13-P691 as part of prerequisites for performing the containment integrated leak test (ILRT). While the l&C technicians attempted to attach the jumper wire, the mini-grabber on the jumper slipped off the terminal connector, made contact with the ground bus, created a short circuit to ground and blew the fuse. This represented a human performance error by the l&C technicians.

A root cause evaluation performed for this event identified the following causes which established the conditions leading to the improper jumper installation:

  • Organizational and individual weaknesses exist with risk perception and mitigation. The pre-job briefing for the ILRT prerequisite task did not include a specific discussion of risk and risk mitigation. The inherent risk of using jumpers, specifically in the installed location, was not recognized and mitigated. Planning/review/scheduling of outage work activities did not include adequate risk determination/risk management.
  • There was continued tolerance and use of less than adequate tools (i.e., procedures, labeling, jumpers, etc) needed for successful task performance. Difficult installation of jumpers and lifted leads had become a routine and accepted practice due to the frequency of use in past work activities and procedures.

  • Work permitted on or near protected equipment is outside industry norms. Control Room panel 1H13-P691 was posted as protected equipment.
  • Use of jumpers, lifted leads, and difficult measuring and test equipment (M&TE) connections had not been rigorously challenged and corrected.

EVENT ANALYSIS

The purpose of the RHR system in MODE 5 is to remove decay heat and sensible heat from the reactor coolant. There are two redundant, manually controlled shutdown cooling subsystems (RHR A/B) available to perform the shutdown cooling function. Each subsystem loop consists of one motor driven pump, two heat exchangers in series, and associated piping and valves. Both subsystems share a common suction from the same recirculation loop. Motor operated valves 1E12-F008 and 1E12-F009 are located in this line to provide inboard and outboard containment isolation. Each pump discharges coolant to the reactor after it has been cooled by circulation through the respective heat exchangers. The RHR heat exchangers transfer heat to the Emergency Service Water System.

In MODE 5, decay heat removal by the RHR system in the shutdown cooling mode is not required for mitigation of any events or accidents evaluated in the safety analyses.

For this event, shutdown cooling was lost for one hour and four minutes in MODE 5. During that time, reactor coolant temperature rose from 94 to 97 degrees F. The reactor coolant time-to-boil was approximately nine hours due to low decay heat level in the core.

The operators promptly verified the alternate methods of decay heat removal were available for the inoperable RHR A/B shutdown cooling subsystems in accordance with TS 3.9.9, Required Action A.1 A qualitative probabilistic risk assessment (PRA) was performed for the duration that shutdown cooling was interrupted. Based on the availability of the Shutdown Cooling function, the timeframe involved before boiling of the reactor vessel inventory was expected, and the other mitigating alignments available to preclude reaching the boiling point had they been required, this event is considered as having a low safety significance. The conclusion of Shutdown Cooling availability is in alignment with the guidance/definition provided in NRC Inspection Manual 0609, Significance Determination Process, Appendix G, Shutdown Operations.

CORRECTIVE ACTIONS

The remaining refueling outage activities were reviewed jointly by Operations and Maintenance to drive improved execution of risk-significant work. The risks were defined and appropriate measures were developed to manage those risks. Among the actions taken were:

  • Sessions were conducted with Maintenance and Operations personnel, reinforcing expectations to consistently use Human Performance tools and behaviors;
  • Identifying and reviewing maintenance activities that could affect shutdown cooling, reactor water level or pressure control, or reactivity management control and developing mitigation strategies for maintenance items identified as risk-significant; and _ NRC FORM 366A (9-2007) PRINTED ON RECYCLED PAPER
  • Flagging work packages with yellow, orange, or red elevated work authorization forms.

A Human. Performance Strategic Plan was developed to establish actions to improve:

  • Organizational and individual risk perception and mitigation;
  • The rigor and intrusiveness for risk assessment of daily work activities; and
  • Site culture with respect to continued tolerance and use of less than adequate tools (procedures/work packages, jumpers, and labels) needed for successful task performance.

The protected equipment process established in Nuclear Operating Instruction (NOP)-0P-1007, "Risk Management," was revised to strengthen the controls, access requirements and limitations for work on protected equipment.

A project plan was created to establish the necessary strategies to identify, prioritize, and implement engineered solutions in order to eliminate the use of difficult jumpers, lifted leads, and M&TE connections. Potential solutions include the use of alternate locations or use of other solutions such as test lugs, test switches, sliding links, test boxes, or use of a robust barrier.

PREVIOUS SIMILAR EVENTS

A review of Perry LERs and the corrective action program database for the past three years found one instance of a loss of shutdown cooling event. On July 11, 2007, with the plant in MODE 4 (Cold Shutdown), the RHR B pump tripped off while operating in shutdown cooling. The pump trip occurred when an l&C technician performing a Reactor Core Isolation. Cooling (RCIC) test unnecessarily loosened a wire connection from an electrical terminal, inducing a current from the RCIC circuitry into the electrically independent RHR B trip system. Plant modifications to separate the wiring and install noise suppression diodes were initiated. This event was reported under LER 2007-002.

Corrective actions for the July 11, 2007, loss of shutdown cooling event were directed toward fixing a latent vendor design deficiency and would not have prevented the April 27, 2009, loss of shutdown cooling event. A common factor in both events, however, is that they were initiated by an l&C human performance error. The individual human performance shortfalls were addressed in accordance with the company's performance management process.

COMMITMENTS

There are no regulatory commitments contained in this report. Actions described in this document represent intended or planned actions, are described for the NRC's information, and are not regulatory commitments.