05000482/LER-2011-004, Regarding Automatic Safety Injection Actuation Due to Operating Crew Failure to Follow Procedures

Regarding Automatic Safety Injection Actuation Due to Operating Crew Failure to Follow Procedures

ML11146A049
Person / Time
Site:	Wolf Creek
Issue date:	05/18/2011
From:	Hedges S Wolf Creek
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
WO 11-0024 LER 11-004-00
Download: ML11146A049 (8)

LER-2011-004, Regarding Automatic Safety Injection Actuation Due to Operating Crew Failure to Follow Procedures

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
4822011004R00 - NRC Website

text

W0LF CREEK

'NUCLEAR OPERATING CORPORATION Stephen E. Hedges Site Vice President May 18, 2011 WO 11-0024 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555

Subject:

Docket No. 50-482: Licensee Event Report 2011-004-00, "Automatic Safety Injection Actuation Due to Operating Crew Failure to Follow Procedure" Gentlemen:

The enclosed Licensee Event Report (LER) is being submitted in accordance with 10 CFR 50.73, "Licensee event report system," paragraph (a)(2)(iv)(A),

50.73(a)(2)(v)(D),

and 50.73(a)(2)(vii).

The LER involves a safety injection actuation and steam line isolation on March 19, 2011, when a main steam isolation valve was opened.

The Attachment provides the regulatory commitments made in this submittal. If you have any questions concerning this matter, please contact me at (620) 364-4190, or Mr. Gautam Sen at (620) 364-4175.

Sincerely, E. Hedges SEH/rlt Attachment Enclosure cc:

E. E. Collins (NRC), w/a, w/e J. R. Hall (NRC), w/a, w/e G. B. Miller (NRC), w/a, w/e Senior Resident Inspector (NRC), w/a, w/e P.O. Box 411 / Burlington, KS 66839 / Phone: (620) 364-8831 An Equal Opportunity Employer M/F/HCNVET

Attachment to WO 11-0024 Page 1 of 1 LIST OF REGULATORY COMMITMENTS The following table identifies those actions committed to by Wolf Creek Nuclear Operating Corporation (WCNOC) in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments. Please direct questions regarding these commitments to Mr. Gautam Sen at (620) 364-4175.

REGULATORY COMMITMENT DUE DATE/EVENT Procedure SYS AB-120, "Main Steam and Steam Dump July 15, 2011 Startup and Operation," will be revised to provide guidance for the appropriate thermal conditions (i.e., temperature, pressure, differential pressure) that must be met before opening an MSIV. The changes will also identify the appropriate instrumentation to be used based on plant conditions. The procedure change will be completed by July 15, 2011.

Procedure AP 15C-002, "Procedure Use and Adherence,"

December 1,2011 will be benchmarked against current industry guidance on procedure adherence including the use of "not applicable" and training provided based on these results.

Accountability on procedure use and adherence will be reinforced through evaluation of operating crews on the simulator and during normal plant operations. These actions will be completed by December 1, 2011.

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2013 (10-2010)

Estimated burden per response to comply with this mandatory collection request: 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />.

Reported lessons learned are incorporated into the licensing process and fed back to industry. Send comments regarding burden estimate to the Records and FOIA/Privacy Service Branch (T-5 F52),

U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by LICENSEE EVENT REPORT (LER) internet e-mail to infocollects@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503.

If a means used to (See reverse for required number of impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required digits/characters for each block) to respond to, the information collection.

3. PAGE WOLF CREEK GENERATING STATION 05000 482 1 OF 6

4. TITLE Automatic Safety Iniection Actuation Due to Operatinq Crew Failure to Follow Procedures

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED SFACILITY NAME DOCKET NUMBER SEQUENTIAL REV MONTH DAY YEAR 05000 MONTH DAY YEAR YEAR NUMBER NO.

05000 FACILITY NAME DOCKET NUMBER 3

19 2011 2011 004 00 5

18 2011 05000

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply)

El 20.2201(b)

[I 20.2203(a)(3)(i)

-] 50.73(a)(2)(i)(C)

M 50.73(a)(2)(vii) 3 [3 20.2201(d)

El 20.2203(a)(3)(ii)

El 50.73(a)(2)(ii)(A)

[I 50.73(a)(2)(viii)(A)

El 20.2203(a)(1)

El 20.2203(a)(4)

[J 50.73(a)(2)(ii)(B)

El 50.73(a)(2)(viii)(B)

El 20.2203(a)(2)(i)

El 50.36(c)(1)(i)(A)

El 50.73(a)(2)(iii)

El 50.73(a)(2)(ix)(A)

10. POWER LEVEL El 20.2203(a)(2)(ii)

[I 50.36(c)(1)(ii)(A)

ED 50.73(a)(2)(iv)(A)

[I 50.73(a)(2)(x)

El 20.2203(a)(2)(iii)

El 50.36(c)(2)

El 50.73(a)(2)(v)(A)

El 73.71(a)(4)

El 20.2203(a)(2)(iv)

El 50.46(a)(3)(ii)

El 50.73(a)(2)(v)(B)

E-73.71(a)(5) 0 El 20.2203(a)(2)(v)

El 50.73(a)(2)(i)(A)

El 50.73(a)(2)(v)(C)

El OTHER E] 20.2203(a)(2)(vi)

El 50.73(a)(2)(i)(B)

ED 50.73(a)(2)(v)(D)

Specify in Abstract below or in NRC Form 366A

12. LICENSEE CONTACT FOR THIS LER FACILITY NAME TELEPHONE NUMBER (Include Area Code)

Gautam Sen, Manager Regulatory Affairs (620) 364-4175MANU-REPORTABLE MANU-REPORTABLE

CAUSE

SYSTEM COMPONENT

CAUSE

SYSTEM COMPONENT FACTUREIR TO EPIX FACTURER TO EPIX

14. SUPPLEMENTAL REPORT EXPECTED

15. EXPECTED MONTH DAY YEAR SUBMISSION El YES (If yes, complete 15. EXPECTED SUBMISSION DATE) 0 NO DATE ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)

On March 19, 2011 at 0000 Central Daylight Time (CDT), the unit was taken offline for the start of a refueling outage. At 0404 CDT with the plant in Mode 3, while opening the "C" main steam isolation valve (MSIV), a safety injection (SI) actuation and steam line isolation occurred. A momentary large steam flow and pressure drop were observed in the affected steam generator. The pressure drop was rapid enough to actuate all three rate-sensitive low steam generator pressure bistables based on rate alone, with the lowest steam pressure still well above the setpoint. The low steam generator pressure bistables cleared prior to MSIV closure.

Control room operators utilized procedure EMG E-0, "Reactor Trip or Safety Injection," at the initiation of the event and EMG ES-03, "SI Termination," to terminate the SI. The SI and steam line isolation resulted in actuation of both trains of Emergency Core Cooling Systems. The steam line isolation signal. closed the only open MSIV. Both diesel generators started and operated in standby mode without tying to the engineered safety features busses. All control rods were previously inserted as part of the controlled shutdown; however, the SI actuation resulted in opening of the reactor trip breakers. Operator action terminated the SI into the Reactor Coolant System (RCS) prior to pressurizer overfill at 0411 CDT.

NRC FORM 366 (10-2010)U.S. NUCLEAR REGULATORY COMMISSION (10-2010)

LICENSEE EVENT REPORT (LER)

1. FACILITY NAME

2. DOCKET

6. LER NUMBER

3. PAGE SEQUENTIAL REV WOLF CREEK GENERATING STATION 05000 482 YEAR NUMBER NO.

2 OF 6

_______________________________j2011 004 00 J______

PLANT CONDITIONS PRIOR TO EVENT Mode 3 On March 19, 2011 at 0000 CDT, the unit was taken offline for the start of a refueling outage. At 0054 CDT the unit entered Mode 3. No inoperable systems, structures, or components (SSCs) contributed to this event on March 19, 2011.

EVENT DESCRIPTION

On March 19, 2011, with reactor power less than 25 percent, after transitioning from procedure GEN 00-004, "Power Operation," to GEN 00-005, "Minimum Load to Hot Standby," control room operators implemented procedure SYS AE-200, "Feedwater Preheating During Plant Startup and Shutdown," for establishing the feedwater preheating system [EIIS codes: SB] for plant cooldown. At 0100 CDT, following Mode 3 entry, the main steam isolation valves (MSIVs) [EIIS codes: SB, ISV] were closed to terminate a cooldown of the reactor coolant system (RCS) [EIIS codes: AB].

Closing the MSIVs to stop the cooldown isolated main steam to secondary systems. The "A" main feedwater pump (MFP) [EIIS codes: SB, P] had not been tripped when the MSIVs were closed. The MFP was subsequently tripped during warmup of the main steam lines for opening the MSIVs. This condition contributed to the inadequate warming of the steam lines.

Procedure SYS AB-120, "Main Steam and Steam Dump Startup and Operation," was implemented for opening the MSIVs when it was determined to continue with the plant cooldown on the steam dump valves to establish the preferred cooldown configuration. All four MSIV bypass valves were opened to warm and pressurize the main steam header. The procedure specifies to ensure the differential pressure across the MSIVs is less than 20 psid using temporary gauges. The procedure indicates that temporary gauges with a range of 0 - 300 psig be installed. This procedure step was marked as "not applicable" since steam generator pressure was approximately 1100 psig and the range of the temporary gauges was much less than current plant conditions. The differential pressure across the MSIVs was determined to be less than 20 psid across the valves using control room installed instrumentation (AB PI-507 and steam generator pressures).

At 0404 CDT, while opening the "C" MSIV, a safety injection (SI) actuation and steam line isolation occurred.

A momentary large steam flow and pressure drop were observed in the affected steam generator. The pressure drop was rapid enough to actuate all three rate-sensitive low steam generator pressure bistables based on rate alone, with the lowest steam pressure still well above the setpoint. The low steam generator pressure bistables cleared prior to MSIV closure.

Control room operators utilized procedure EMG E-0, "Reactor Trip or Safety Injection," at the initiation of the event and EMG ES-03, "SI Termination," to terminate the SI. The SI and steam line isolation resulted in actuation of both trains of Emergency Core Cooling Systems (ECCS) [EIIS codes: BQ/BP] and injection into the reactor vessel [EIIS codes: AB, RPV]. The steam line isolation signal closed the only open MSIV. Both diesel generators [EIIS codes: EK] started and operated in standby mode without tying to the engineered safety features busses [EIIS codes: EB, BU]. All control rods were previously inserted as part of the controlled shutdown; however, the SI actuation resulted in opening of the reactor trip breakers. Operator action terminated the SI into the RCS prior to pressurizer overfill at 0411 CDT.U.S. NUCLEAR REGULATORY COMMISSION (10-2010)

LICENSEE EVENT REPORT (LER)

1. FACILITY NAME

2. DOCKET

6. LER NUMBER

3. PAGE SEQUENTIAL I REV WOLF CREEK GENERATING STATION 05000 482 YEAR NUMBER NO.

3 OF 6

2011 004 00 Subsequent review determined that when the "C" MSIV was opened, temperature points from the plant computer for the main steam line were indicating an average temperature of 533.9 degrees F. The steam table pressure conversion for this temperature is approximately 900 psig. When the MSIV was opened existing steam generator pressures were approximately 1100 psig, which equates to a differential pressure of approximately 200 psig across the MSIVs.

BASIS FOR REPORTABILITY This event is reportable pursuant to 10 CFR 50.73(a)(2)(iv)(A) as an event or condition that resulted in a valid automatic actuation of systems listed in paragraph (a)(2)(iv)(B) of this section of 10 CFR 50.73. The actuation was not part of a pre-planned sequence during testing or reactor operation.

Control room operators utilized procedure EMG E-0, "Reactor Trip or Safety Injection," at the initiation of the event and EMG ES-03, "SI Termination," to terminate the SI. The actions of these procedures result in the operators performing a manual reset of SI. The manual reset of SI following a 60 second time delay, in conjunction with Reactor Trip, P-4 interlock, generates an automatic block of SI. Manual reset of SI is necessary to restore the actuated equipment to standby as appropriate. TS 3.3.2, Function 1.b, Safety Injection - Automatic Actuation Logic and Actuation Relays, requires 2 channels operable in Modes 1, 2, and

3. Once SI is blocked, automatic actuation of SI cannot occur until the reactor trip breakers have been manually closed. The reactor trip breakers were closed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 39 minutes after the initiation of the event. The manual reset of SI to terminate the safety injection is necessary to prevent overfilling the pressurizer when a steam line break was not present. However, this results in blocking both channels of SI automatic actuation logic. Therefore, this event is being reported under 10 CFR 50.73(a)(2)(v)(D) as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. The capability to manually initiate SI was still available.

This event is also reportable under 10 CFR 50.73(a)(2)(vii) as an event where a single cause resulted in two independent trains or channels to become inoperable in a single system designed to mitigate the consequences of an accident. The manual reset of SI is a single action taken that results in the automatic block of both channels of the SI actuation logic.

An initial 50.72 notification (EN 46685) was made under 10 CFR 50.72(b)(2)(iv)(A) for an event that resulted in an ECCS discharge into the RCS as a result of a valid signal. A followup notification was made to indicate that the event was reportable under 10 CFR 50.72(b)(3)(iv)(A) as an event that results in a valid actuation of the Reactor Protection System, ECCS, and emergency ac power systems, and 10 CFR 50.72(b)(3)(v) as an event that could have prevented the fulfillment of the safety function of SSCs that are needed to mitigate the consequences of an accident.

ROOT CAUSE The root cause of this event was the failure of the operating crew to follow procedure SYS AB-120. The operating crew did not follow the guidance in procedure AP 15C-002, "Procedure Use and Adherence,"

when a SYS AB-120 step that was tied to a precaution and limitation step was marked "not applicable."

Because the SYS AB-120 procedural guidance was not followed, a SI occurred when the "C" MSIV was opened. Differential pressure across the valves was not equalized and was greater than 20 psid.U.S. NUCLEAR REGULATORY COMMISSION (10-2010)

LICENSEE EVENT REPORT (LER)

1. FACILITY NAME

2. DOCKET

6. LER NUMBER

3. PAGE SEQUENTIAL I REV WOLF CREEK GENERATING STATION 05000 482 YEAR NUMBER NO1 4

OF 6

2011 004 00 The gauges available in the control room did not provide the required resolution to ensure 20 psid had been reached. Assumptions were made without utilizing the steam tables to validate whether the 20 psid had been reached. Instead of following procedural guidance the crew was influenced by the previous performance (October 15, 2010) of SYS AB-120, which opened the MSIVs at approximately 30 psid even though the plant conditions were different.

A contributing cause was procedure SYS AB-1 20 did not provide the operating crew with the necessary guidance (e.g. time, temperature, and condensate removal) for ensuring main steam lines were adequately warmed prior to opening the MSIVs. SYS AB-1 20 provides instructions for warmup of the main steam system, opening the MSIVs, aligning the steam dump system for operation, and the use of auxiliary medium on the MSIVs. The procedure step for installing the gauge prior to opening the "C" MSIV did not meet the operating criteria established because it was not written for the plant conditions that existed (1100 psig).

A second contributing cause was the operations management oversight individual did not challenge the crew when problems were encountered; instead he allowed them to proceed without involving additional plant personnel. The principal function of the oversight manager is to challenge the evolution if problems are encountered. The operations management oversight was present for the plant cooldown; however, the oversight manager stepped out of the primary role to facilitate moving forward instead of stopping when problems were encountered.

A third contributing cause for this event was the guidance in procedure SYS AE-200 did not clearly state that the main steam flow to feedwater heaters was to be adjusted using the controller setpoint which contributed to the cooldown requiring MSIV closure. The procedure directs the controller be placed in automatic control and indicates that adjustment of the setpoint is allowed if the feedwater heater temperature limit is approached. Adjustment of the setpoint is performed with the controller in automatic by using the setpoint control thumbwheel.

CORRECTIVE ACTIONS

Transient event walkdowns of RCS equipment in containment and secondary plant equipment were performed. Actions were taken to resolve discrepancies identified from these walkdowns.

Essential reading was issued on March 25, 2011 to operations personnel for procedure AP 15C-002, "Procedure Use and Adherence," and the acceptable use of identifying steps as "not applicable" during procedure usage.

Procedure AP 15C-002, "Procedure Use and Adherence," will be benchmarked against current industry guidance on procedure adherence including the use of "not applicable" and training provided based on these results. Accountability on procedure use and adherence will be reinforced through evaluation of operating crews on the simulator and during normal plant operations. These actions will be completed by December 1, 2011.U.S. NUCLEAR REGULATORY COMMISSION (10-2010)

LICENSEE EVENT REPORT (LER)

1. FACILITY NAME

2. DOCKET

6. LER NUMBER

3. PAGE SEQUENTIAL I REV WOLF CREEK GENERATING STATION 05000 482 YEAR NUMBER NO.

5 OF 6

2011 004 00 Procedure SYS AB-1 20, "Main Steam and Steam Dump Startup and Operation," will be revised to provide guidance for the appropriate thermal conditions (i.e., temperature, pressure, differential pressure) that must be met before opening an MSIV. The changes will also identify the appropriate instrumentation to be used based on plant conditions. The procedure change will be completed by July 15, 2011.

Procedure SYS AE-200, "Feedwater Preheating During Plant Startup and Shutdown," was revised on April 12, 2011 to clarify the notes and step to ensure the controller is maintained in automatic when adjustments are required to prevent exceeding feedwater heater differential temperatures.

SAFETY SIGNIFICANCE

The SI produced a transient to the RCS. All major equipment functioned within its design capability. The SI transient is bounded by accident analyses discussed in Updated Safety Analysis Report (USAR) Section 15.5.1, "Inadvertent Operation Of the Emergency Core Cooling System During Power Operation." The primary concern that results from an inadvertent actuation of the ECCS at power is that associated with pressurizer overfill. The pressurizer water volume increases as a result of the SI flow. This may eventually lead to filling of the pressurizer and subsequent water relief through the safety or relief valves. The passing of liquid through the pressurizer safety or relief valves could result in rupture of the pressurizer relief tank rupture disks, spilling radioactive coolant into the containment building, thereby escalating a Condition II event to a Condition III or IV event. To prevent the pressurizer from becoming water-solid operator action is ultimately required to terminate SI or mitigate the consequences of this event. In this specific event, the SI occurred with the reactor in shutdown conditions, all rods inserted, and shutdown boration completed.

Turbine trip signals and reactor trip signals were generated, but both the turbine and reactor were shutdown.

The pressurizer power operated relief valves (PORVs) operated to mitigate the pressurizer insurge pressure transient. Operator action terminated the SI into the RCS prior to pressurizer overfill. Pressurizer level reached 87.5 percent during the SI event. As such, this transient was bounded by the analysis described in USAR Section 15.5.1.

When the "C" MSIV was opened, a rapid decrease in main steam line pressure occurred. The transient is bounded by the analyzed condition of a steam line break (SLB) while the plant is at hot zero power (HZP).

The postulated SLB at HZP accident analysis most closely represents the plant conditions that existed during this event. Opening the MSIV gave a rapid change in steam header pressure, as would a SLB and the plant was at HZP conditions. The postulated SLB at HZP accident analysis results in a rapid loss of pressure and an excessive cooldown of the RCS. The postulated SLB at HZP as analyzed in USAR Section 15.1 represents a greater than 100 degree/hour cooldown, and it also assumes that the most reactive control rod is stuck out. The SLB at HZP bounds the transient for this event since the reactor was shut down with all control rods inserted and boron had been added during the shutdown. There was no actual failure of the main steam line piping. An actual SLB event from HZP would produce a cooldown in excess of 150 degrees/hour. For this event the cooldown was only four degrees on the affected loop and there was no prolonged steam flow. Steam generator pressure was restored when the MSIV reclosed as a result of the steam line isolation signal.U.S. NUCLEAR REGULATORY COMMISSION (10-2010)

LICENSEE EVENT REPORT (LER)

1. FACILITY NAME

2. DOCKET

6. LER NUMBER

3. PAGE SEQUENTIAL REV WOLF CREEK GENERATING STATION 05000 482 YEAR NUMBER NO 6

OF 6

2011 004 00 OPERATING EXPERIENCE/PREVIOUS EVENTS LER 2010-012-00: On October 17, 2010 at 0952 CDT, Wolf Creek Generating Station was at approximately 15 percent power during a startup when a turbine trip and feedwater isolation signal occurred due to high-high steam generator level. The MSIVs were closed due to cooldown after the plant trip and were subsequently reopened. Difficulty was experienced in getting the MSIVs to immediately reopen when the handswitches were first depressed. It was noted at the time that procedure SYS AB-120 did not include guidance for opening a MSIV at normal operating temperature and pressure.

On March 5, 2010, while in Mode 4, a feedwater isolation signal occurred due to a high water level on "A" steam generator. The high water level occurred due to swell caused by opening the "A" MSIV. As a result of this event, changes were made to procedure SYS AB-120 to use temporary gauges with higher accuracy to ensure differential pressure limits were actually met and to lower steam generator levels prior to opening the MSIV. At the time the MSIV was opened, the RCS was in heatup. If the RCS temperature is not held constant for some period of time, equalization of pressure cannot be assured.

LER 85-021-00: On April 28, 1985, an engineered safety features actuation occurred resulting in a safety injection actuation and main steam line isolation. The initiating signal was low steam line pressure on the "D" steam generator. The cause of the low steam line pressure signal was determined to be an anticipatory trip generated by the rate sensitive steam generator pressure circuitry due to a decrease in steam line pressure when a MSIV was opened before pressure was equalized through the MSIV bypass valves. At the time of the event, the plant was in Mode 3 prior to initial criticality.

Prior corrective actions for the above events did not adequately assess the necessary procedural guidance and instrumentation necessary to prevent an increased potential for a safety injection to occur. The corrective actions from the March 5, 2010 event primarily focused on steam generator water level and preventing a reoccurrence of a feedwater isolation when opening a MSIV.