05000482/LER-2012-002

LER-2012-002, . One Train of Automatic Safety Infection Blocked During Entry Into Mode 3 Due To Procedural Weakness

Docket Number
Event date:	03-19-2012
Report date:	05-17-2012
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
4822012002R00 - NRC Website

No inoperable structures, components or systems, other than the train 'A' automatic safety injection (SI) actuation signal, contributed to this event on March 19-20, 2012.

BACKGROUND:

When a Safety Injection (SI) signal is received, the SI block circuitry design allows that, after a 60 second delay, the SI signal can be reset/blocked, allowing the operator to take control and recover as appropriate. The block is an overriding block, allowing the reset/block to be inserted, even if the initiating SI signal is still present. The block also prevents automatic SI re-initiation. By design, the block remains until reset by the closing of the reactor trip breakers. Only the automatic SI functions can be blocked, the manual SI function is not affected.

During normal plant refueling outages, procedure STS KJ-001A, "Integrated D/G and Safeguards Actuation Test — Train A," and procedure STS KJ-001B, "Integrated D/G and Safeguards Actuation Test — Train B," are performed for both the 'A' and 'B' Emergency Diesel Generators (DG) [EllS Code:

EK] during Mode 5. During this testing, a Safety Injection (SI) signal is initiated to ensure that the Loss of Coolant Accident (LOCA) sequencer [ElIS Code: JE] goes through all the required actuations. After testing is completed, the SI manual reset buttons for train 'A' and 'B' are depressed which resets both trains of automatic SI actuation. Though procedure STS KJ-001A and B allows restoration of the automatic SI actuation by referring the test performer to procedure OFN EM-024, "Safety Injection Recovery," plant conditions normally do not allow it since the plant is in Mode 5.

Permissive P-4 remains active until the reactor trip breakers [EllS Code: JC, BKR] are closed. P-4 prevents the automatic re-initiation of SI after manual reset and illuminates the auto SI block status window on control room panel SB069.

Normally, prior to entry into Mode 4, the Solid State Protection System (SSPS) [EllS Code: JG] is enabled using procedure SYS SB-120, "Enabling/Disabling of SSPS for both 'A' and 'B' trains," which resets the SI actuation logic and relays. After entry into Mode 4 and prior to Mode 3, procedure STS RE-017, "DRPI (Digital Rod Position Indication) Operability Verification," is performed. This procedure requires that the reactor trip breakers be closed and resets the auto SI block. As a result, automatic SI actuation is operable and the Auto SI Block status window on control room panel SB069 is extinguished.

DESCRIPTION OF THE EVENT:

During a forced outage, a portion of procedure STS KJ-001A was performed as a required retest for maintenance conducted on the 'A' DG in March 2012 while in Mode 5. After the testing was completed, both SI manual reset buttons for train 'A' and B' were depressed. Due to the reactor trip breakers being open, the auto SI block status window was lit. The 'B' train of automatic SI actuation was not blocked since it had never been actuated.

Prior to entry into Mode 4, both trains of SSPS were enabled which reset the actuation logic and relays. As this was a forced outage, procedure STS RE-017 was not required to be performed and the reactor trip breakers were not closed. Entry was made into Mode 3 on March 19, 2012, at 0327 CDT, with the 'A' train of automatic SI actuation signal being inoperable. On March 20, 2012, during a main control board walkdown, a licensed operator noticed the auto SI block status light lit. For the Mode the plant was in, this light should not have been lit. Approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> after entry into Mode 3, on March 20, 2012, at 0945 CDT, the reactor trip breakers were closed, resetting the 'A' train SI block, making the 'A' train of automatic SI actuation operable.

BASIS FOR REPORTABILITY:

This event is reportable under 10 CFR 50.73(a)(2)(i)(B) as an operation or condition prohibited by Technical Specifications (TS). The plant transitioned from Mode 4 to Mode 3 on March 19, 2012, with TS Table 3.3.2-1, Function 1.b, Automatic Action Logic and Actuation Relays, inoperable. Therefore, Limiting Condition for Operation (LCO) 3.0.4 was not met when the plant transitioned from Mode 4 to Mode 3.

ROOT CAUSE:

Inadequate procedural guidance existed to ensure that required signals are available in the Modes of applicability, and prior to Mode changes.

Procedure STS KJ-001A did not contain a step to either have the operators restore automatic SI actuation by closing the reactor trip breakers or making an Equipment Out of Service log (EOL) entry to restore automatic SI actuation as a Mode 3 restraint. STS KJ-001A does direct the operator to procedure OFN EM-024, "Safety Injection Recovery." The first step of OFN EM-024 directs the operator to determine whether automatic SI capability will be restored. Automatic SI capability could not be restored with the plant in Mode 5.

Additionally, procedure GEN 00-002, "Cold Shutdown to Hot Standby," did not contain a step to ensure that the auto SI block logic is reset, or the reactor trip breakers are closed, prior to Mode 3 entry.

During past outages this issue had not been identified due to performing procedure STS RE-017 in Mode 4 prior to entry into Mode 3. This procedure requires the reactor trip breakers to be closed which resets the auto SI block logic.

CORRECTIVE ACTIONS:

Procedure GEN 00-002, "Cold Shutdown to Hot Standby," was revised on March 26, 2012, to ensure that the auto SI block status window is not lit prior to entry into Mode 4. This action ensures automatic SI actuation is operable.

STS KJ-001A and B will be revised to either close the reactor trip breakers or to make an EOL entry to reset auto SI block prior to entry into Mode 4.

Prior to entering Mode 3 both trains of automatic SI actuation are required. During this event, only the train 'B' automatic SI actuation was available. Had a train 'B' automatic SI been actuated, the procedure network requires that control room personnel manually actuate the train 'A' SI. Manual SI actuation was not blocked and would have functioned.

The safety significance of this event was low. The automatic SI signal was available for train `B,' and a manual SI signal could have been actuated for train 'A.' The Wolf Creek Generating Station Probabilistic Risk Assessment model was used to gauge the risk of the block of the automatic SI actuation signal. The results show a low value for Incremental Conditional Core Damage Probability, which indicates low risk significance. At the time of the event, the capability for manual SI was still available during the block of the automatic signal. The core decay heat at the time of the event was quite low since the plant had been shut down since January 13, 2012.

The RCS pressure at the time the reactor trip breakers were closed was approximately 1900 psig. The probability of a Large Loss of Coolant Accident (LOCA), Medium LOCA, or Steam Generator Tube Rupture would be less than the nominal probability assumed in the At-Power risk model.

OPERATING EXPERIENCE/PREVIOUS SIMILAR OCCURRENCES:

None