05000440/LER-2010-001, Regarding Invalid Isolation Signal Results in Shutdown Cooling Interruption

Regarding Invalid Isolation Signal Results in Shutdown Cooling Interruption

ML100920094
Person / Time
Site:	Perry
Issue date:	03/25/2010
From:	Bezilla M FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-10-069 LER 10-001-00
Download: ML100920094 (6)

LER-2010-001, Regarding Invalid Isolation Signal Results in Shutdown Cooling Interruption

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii) 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
4402010001R00 - NRC Website

text

FENOC FirstEnergy Nuclear Operating Company Perry Nuclear Power Station 10 Center Road Perry, Ohio 44081 Mark B. Bezilla Vice President 440-280-5382 Fax: 440-280-8029 March 25,-2010 L-1 0-069 ý 10 CFR 50.73(a)(2)(v)(B)

ATTN,: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Perry Nuclear Power Plant Docket No. 50-440, License No. NPF-58:

Licensee Event Report Submittal Enclosed is Licensee Event Report (LER) 2010-001, "Invalid Isolation Signal Results in Shutdown Cooling Interruption," There are no regulatory~commitments contained in this submittal.

If there are any, questions or if additional information is required, please contact Mr. Robert Coad, Manager - Regulatory Compliance, at (440) 280-5328.

Sincerely, Mark B. Bezilla.

Enclosure:

LER,2010-001.1 cc:

NRC Project Manager NRC Resident Inspector NRC Region III

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150-0104 EXPIRES 8/31/2010 (9-2007)

, the NRC may (See reverse for required number of not conduct or sponsor, and a person is not required to respond to, the digits/characters for each block) information collection.

3. PAGE Perry Nuclear Power Plant 05000440 1 OF 5

4. TITLE Invalid Isolation Signal Results in Shutdown Cooling Interruption

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED SEQUENTIAL REV IFACILITY NAME DOCKET NUMBER MONTH DAY YEAR YER NUMBER NO.

MONTH DAY YEAR 04 27 2009 2010 -

001

- 00 03 25 2010iFACLITYNAME DOCKET NUMBER

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)

[] 20.2201(b) 17 20.2203(a)(3)(i)

[D 50.73(a)(2)(i)(C)

E] 50.73(a)(2)(vii) 5 E] 20.2201(d)

E] 20.2203(a)(3)(ii)

[

50.73(a)(2)(ii)(a)

[

50.73(a)(2)(viii)(A)

[]20.2203(a)(1)

[*] 20.2203(a)(4)

E] 50.73(a)(2)(ii)(B)

[:1 50,73(a)(2)(viii)(B)

[

20.2203(a)(2)(i)

El 50.36(c)(1)(i)(A)

E] 50.73(a)(2)(iii)

El 50.73(a)(2)(ix)(A)

10. POWER LEVEL LI 20.2203(a)(2)(ii)

[_

50.36(c)(1)(ii)(A)

Ej 50.73(a)(2)(iv)(A)

LI 50.73(a)(2)(x)

Ej 20.2203(a)(2)(iii)

LI 50.36(c)(2)

LI 50.73(a)(2)(v)(A) 0 73.71(a)(4) 0 LI 20.2203(a)(2)(iv)

LI 50.46(a)(3)(ii)

[

50.73(a)(2)(v)(B)

[: 73.71(a)(5)

LI 20.2203(a)(2)(v)

[] 50.73(a)(2)(i)(A)

LI 50.73(a)(2)(v)(C)

I[:

OTHER Specify in Abstract below

_ _ 20.2203(a)(2)(vi)

El 50.73(a)(2)(i)(B)

LI 50.73(a)(2)(v)(D) or in At 1735 hours0.0201 days <br />0.482 hours <br />0.00287 weeks <br />6.601675e-4 months <br />, a blown fuse was discovered in control room panel 1 H1 3-P691. The fuse services the circuit that provides 24 vdc electrical power to Trip Unit Card File & Calibration Unit Z1A. When the fuse blew, the 24 vdc electrical power was lost to Trip Unit 1 B21-N679A "Reactor Pressure High." Relay 1 B21-K124A de-energized, which caused automatic closure of valve 1E12-F008 and the subsequent automatic tripping of the RHR A pump, as designed.

Plant operators pursued parallel paths (both local and remote) to manually realign the valve for RHR B subsystem operation. At 1816 hours0.021 days <br />0.504 hours <br />0.003 weeks <br />6.90988e-4 months <br />, the fuse was replaced. The isolation logic initiated by the blown fuse was reset. Valve 1 El 2-F008 was aligned manually to the open position from the control room to support RHR B subsystem operation. At 1834 hours0.0212 days <br />0.509 hours <br />0.00303 weeks <br />6.97837e-4 months <br />, the RHR B pump was started to restore shutdown cooling operation in compliance with TS LCO 3.9.9. The amount of time that RHR shutdown cooling was interrupted was one hour and four minutes. During that time, reactor coolant temperature increased three degrees F from 94 to 97 degrees F.

On April 28, 2009, after performing fill and vent activities on the RHR A subsystem, at 0430 hours0.00498 days <br />0.119 hours <br />7.109788e-4 weeks <br />1.63615e-4 months <br />, the RHR A subsystem was declared operable and TS LCO 3.9.9, Condition A was exited. At 0458 hours0.0053 days <br />0.127 hours <br />7.572751e-4 weeks <br />1.74269e-4 months <br />, the RHR A subsystem was started in the normal shutdown cooling lineup and at 0513 hours0.00594 days <br />0.143 hours <br />8.482143e-4 weeks <br />1.951965e-4 months <br />, the RHR B subsystem-was placed in standby.

CAUSE OF EVENT

The interruption of RHR shutdown cooling system operation was caused by a blown fuse which sent an isolation signal to valve 1 E12-F008. Closure of this valve sent an automatic trip signal to the operating RHR A subsystem and, with the valve now closed, prevented immediate startup of the RHR B pump to restore shutdown cooling.

The fuse blew while Instrumentation and Control (I&C) technicians were installing a jumper in control room panel 1H13-P691 as part of prerequisites for performing the containment integrated leak test (ILRT). While the I&C technicians attempted to attach the jumper wire, the mini-grabber on the jumper slipped off the terminal connector, made contact with the ground bus, created a short circuit to ground and blew the fuse. This represented a human performance error by the I&C technicians.

A root cause evaluation performed for this event identified the following causes which established the conditions leading to the improper jumper installation:

Organizational and individual weaknesses exist with risk perception and mitigation. The pre-job briefing for the ILRT prerequisite task did not include a specific discussion of risk and risk mitigation. The inherent risk of using jumpers, specifically in the installed location, was not recognized and mitigated. Planning/review/scheduling of outage work-activities did not include adequate risk determination/risk management.

There was continued tolerance and use of less than adequate tools (i.e., procedures, labeling, jumpers, etc) needed for successful task performance. Difficult installation of jumpers and lifted leads had become a routine and accepted practice due to the frequency of use in past work activities and procedures.

Work permitted on or near protected equipment is outside industry norms. Control Room panel 1 H1 3-P691 was posted as protectedequipment.

Use of jumpers, lifted leads, and difficult measuring and test equipment (M&TE) connections had not been rigorously challenged and corrected.

EVENT ANALYSIS

The purpose of the RHR system in MODE 5 is to remove decay heat and sensible heat from the reactor coolant. There are two redundant, manually controlled shutdown cooling subsystems (RHR A/B) available to perform the shutdown cooling function. Each subsystem loop consists of one motor driven pump, two heat exchangers in series, and associated piping and valves. Both subsystems share a common suction from the same recirculation loop. Motor operated valves 1E12-F008 and 1El*2-F009 are located in this line to provide inboard and outboard containment isolation. Each pump discharges coolant to the reactor after it has been cooled by circulation through the respective heat exchangers. The RHR heat exchangers transfer heat to the Emergency Service Water System.

In MODE 5, decay heat removal by the RHR system in the shutdown cooling. mode is not required for mitigation of any events or accidents evaluated in the safety analyses.

For this event, shutdown cooling was lost for one hour and four minutes in MODE 5. During that time, reactor coolant temperature rose from 94 to 97 degrees F. The reactor coolant time-to-boil was approximately nine hours due to low decay heat level in the core.

The operators promptly verified the alternate methods of decay heat removal were available for the inoperable RHR A/B shutdown cooling subsystems in accordance with TS 3.9.9, Required Action A.1.

A qualitative probabilistic risk assessment (PRA) was performed for the duration that shutdown cooling was interrupted. Based on the availability of the Shutdown Cooling function, the timeframe involved before boiling of the reactor vessel inventory was expected, and the other mitigating alignments available to preclude reaching the boiling point had they been required, this event is considered as having a low safety significance. The conclusion of Shutdown Cooling availability is in alignment with the guidance/definition provided in NRC Inspection Manual 0609, Significance Determination Process, Appendix G, Shutdown Operations.

CORRECTIVE ACTIONS

The remaining refueling outage activities were reviewed jointly by Operations and Maintenance to drive improved execution of risk-significant work. The risks were defined and appropriate measures were developed to manage those risks. Among the actions taken were:

Sessions were conducted with Maintenance and Operations personnel, reinforcing expectations to consistently use Human Performance tools and behaviors; Identifying and reviewing maintenance activities that could affect shutdown cooling, reactor water level or pressure control, or reactivity management control and developing mitigation strategies for maintenance items identified as risk-significant; and

Flagging work packages with yellow, orange, or red elevated work authorization forms.

A Human Performance Strategic Plan was developed to establish actions to improve:

Organizational and individual risk perception and mitigation; The rigor and intrusiveness for risk assessment of daily work activities; and Site culture with respect to continued tolerance and use of less than adequate tools (procedures/work packages, jumpers, and labels) needed for successful task performance.

The protected equipment process established in Nuclear Operating Instruction (NOP)-OP-1007, "Risk Management," was revised to strengthen the controls, access requirements and limitations for work on protected equipment.

A project plan was created to establish the necessary strategies to identify, prioritize, and implement engineered solutions in order to eliminate the use of difficult jumpers, lifted leads, and M&TE connections. Potential solutions include the use of alternate locations or use of other solutions such as test lugs, test switches, sliding links, test boxes, or use of a robust barrier.

PREVIOUS SIMILAR EVENTS

A review of Perry LERs and the corrective action program database for the past three years found one instance of a loss of shutdown cooling event. On July 11, 2007, with the plant in MODE 4 (Cold Shutdown), the RHR B pump tripped off while operating in shutdown cooling. The pump trip occurred when an I&C technician performing a Reactor Core Isolation Cooling (RCIC) test unnecessarily loosened a wire connection from an electrical terminal, inducing a current from the RCIC circuitry into the electrically independent RHR B trip system. Plant modifications to separate the wiring and install noise suppression diodes were initiated. This event was reported under LER 2007-002.

Corrective actions for the July 11, 2007, loss of shutdown cooling event were directed toward fixing a latent vendor design deficiency and would not have prevented the April 27, 2009, loss of shutdown cooling event. A common factor in both events, however, is that they were initiated by an I&C human performance error. The individual human performance shortfalls were addressed in accordance with the company's performance management process.

COMMITMENTS

There are no regulatory commitments contained in this report. Actions described in this document represent intended or planned actions, are described for the NRC's information, and are not regulatory commitments.PRINTED ON RECYCLED PAPERPRINTED ON RECYCLED PAPER