05000440/LER-2016-004

LER-2016-004, Loss of Safety Function Due to Two Inoperable Standby Liquid Control Subsystems

Perry Nuclear Power Plant
Event date:	12-28-2016
Report date:	02-24-2017
Reporting criterion:	10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor
Initial Reporting
ENS 52468	10 CFR 50.72(b)(3)(v)(A), Loss of Safety Function - Shutdown the Reactor, 10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
4402016004R00 - NRC Website

LER 16-004-00 for Perry Regarding Loss of Safety Function Due to Two Inoperable Standby Liquid Control Subsystems

ML17055C355
Person / Time
Site:	Perry
Issue date:	02/24/2017
From:	Hamilton D B FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-17-019 LER 16-004-00
Download: ML17055C355 (6)

used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

440 - 004 - 00 Perry Nuclear Power Plant 05000 - YEAR 2016 Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

INTRODUCTION

On December 28, 2016, at 2229 hours0.0258 days <br />0.619 hours <br />0.00369 weeks <br />8.481345e-4 months <br /> (EST), both standby liquid control (SLC) [BR] subsystems were declared inoperable due to performance of a surveillance test on subsystem A and the indicated loss of continuity to a firing circuit on the discharge valve for subsystem B.

With both subsystems having been declared inoperable, this was determined to be a reportable event under 10 CFR 50.72(b)(3)(v)(A) and 10 CFR 50.72(b)(3)(v)(D) for an event or condition that that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition and mitigate the consequences of an accident. As such, an event notification was made to the NRC Operations Center and recorded under Event Number 52468.

This event is being reported in accordance with 10 CFR 50.73(a)(2)(v)(A) and 10 CFR 50.73(a)(2)(v)(D), which requires reporting of any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition and mitigate the consequences of an accident. This was not a safety system functional failure since discharge valve B would have operated as designed and supported chemical injection to the vessel.

DESCRIPTION OF EVENT

On December 28, 2016, at 2119 hours0.0245 days <br />0.589 hours <br />0.0035 weeks <br />8.062795e-4 months <br />, with the plant in mode 1 at 98 percent power, SLC subsystem A was declared inoperable for performance of a routine surveillance test. Technical Specification (TS) Limiting Condition for Operation (LCO) 3.1.7, Action A was entered, which required restoring the single subsystem to operable status within 7 days.

On December 28, 2016, at 2229 hours0.0258 days <br />0.619 hours <br />0.00369 weeks <br />8.481345e-4 months <br />, the control room received an out-of-service alarm for SLC subsystem B directly after pump A was started in accordance with the surveillance instruction. Control room operators verified this alarm to be due to an indicated loss of continuity to discharge valve B, as read on a control room indicator. At 2229 hours0.0258 days <br />0.619 hours <br />0.00369 weeks <br />8.481345e-4 months <br />, SLC subsystem B was declared inoperable and TS LCO 3.1.7, Action B was entered, which required restoring one SLC subsystem to operable status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. With both subsystems declared inoperable, the SLC system was in a condition that rendered it unable to fulfill its safety function.

On December 28, 2016, at 2257 hours0.0261 days <br />0.627 hours <br />0.00373 weeks <br />8.587885e-4 months <br />, pump A was stopped in accordance with the surveillance instruction and at 2302 hours0.0266 days <br />0.639 hours <br />0.00381 weeks <br />8.75911e-4 months <br />, the SLC B out-of-service alarm reset. Following performance of the surveillance test at 2335 hours0.027 days <br />0.649 hours <br />0.00386 weeks <br />8.884675e-4 months <br />, SLC subsystem A was declared operable and TS LCO 3.1.7, Action B was exited.

Troubleshooting determined that the cause for SLC subsystem B inoperability was an indicated loss of continuity to one of the two firing circuits in the discharge valve. On December 29, 2016, at 1708 hours0.0198 days <br />0.474 hours <br />0.00282 weeks <br />6.49894e-4 months <br />, SLC subsystem B was declared operable and TS LCO 3.1.7, Action A was exited after repairs were completed.

CAUSE OF EVENT

Continuity was interrupted by a high resistance in a connector to one of the two firing circuits for discharge valve B. This brought in the alarm as expected for this condition and also reduced the available firing circuits used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

440 - 004 - 00 Perry Nuclear Power Plant 05000 - YEAR 2016 from two to one. Since the other firing circuit was complete, discharge valve B would have operated as designed and supported chemical injection to the vessel if it received an initiation signal. However, Surveillance Requirement (SR) 3.1.7.4, which verifies continuity of the explosive charges, was not met and on December 28, 2016 from 2229 hours0.0258 days <br />0.619 hours <br />0.00369 weeks <br />8.481345e-4 months <br /> to 2335 hours0.027 days <br />0.649 hours <br />0.00386 weeks <br />8.884675e-4 months <br />, with both systems declared inoperable, the system was administratively in a condition that rendered it unable to fulfill its safety function.

The event was isolated to a small section of the cable that connects the discharge valve to the 120 VAC power supply. The direct cause for the loss of continuity to one of the two firing circuits in discharge valve B was a loose connection between a pin and jack on the connector. The apparent cause of the event was the preventative maintenance (PM) scope did not have a step to inspect the condition of the pins and jack in this connection, which allowed the wear to go undetected until it was self-revealed via an equipment issue.

ANALYSIS OF EVENTS

The safety function of the SLC system is to mitigate the consequences in the event that not enough control rods can be inserted in the reactor core to accomplish shutdown and cool-down in the normal manner, and to provide a pH buffering solution for injection into the reactor vessel suppression pool following a design basis LOCA. The system is manually initiated from the control room and consists of a boron solution tank, two positive displacement pumps and two explosive valves (discharge valves), which are provided in parallel for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel. The system is not a backup scram system for the reactor, but an independent backup system for the control rod drive (CRD) [AA] system. At the time of the event, the CRD system was operable and available.

Each discharge valve uses explosive charges as their opening mechanisms, which are electrically operated.

Each explosive charge contains two independent firing circuits, also known as primers, and a small electrical current continuously tests for continuity. For continuity testing, the charges are in series, therefore a break in any part of the circuit would break continuity and provide an out-of-service alarm in the control room. When called upon to function (i.e., fire the explosive charge), power is directed to the two independent firing circuits in parallel, meaning the electrical path for firing of the explosive charge is different than the electrical path for testing continuity.

A probabilistic risk assessment (PRA) evaluation of this event notes that the function of the Standby Liquid Control System remained available since discharge valve B would have operated as designed and supported chemical injection to the vessel. On this basis there would be no impact to the PRA model, and therefore no corresponding change (delta) in core damage frequency (CDF) and no corresponding change (delta) in large early release frequency (LERF). The delta CDF and delta LERF values are well below the acceptable thresholds of 1.0E-06/year and 1.0E-07/year, respectively, as discussed in Regulatory Guide 1.174. The risk of this event is therefore considered small in accordance with the regulatory guidance.

With both subsystems having been declared inoperable, this was determined to be a reportable event under 10 CFR 50.72(b)(3)(v)(A) and 10 CFR 50.72(b)(3)(v)(D) for an event or condition that that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition and mitigate the consequences of an accident. As such, an event notification was made to the NRC Operations Center and recorded under Event Number 52468.

used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

440 - 004 - 00 Perry Nuclear Power Plant 05000 - YEAR 2016 Although it was subsequently determined that SLC subsystem B would have functioned if called upon and thus the safety function would have been met, this event is being reported in accordance with 10 CFR 50.73(a)(2)(v)(A) and 10 CFR 50.73(a)(2)(v)(D), as follow-up to the 10 CFR 50.72(b)(3)(v)(A) and 10 CFR 50.72(b)(3)(v)(D) notification made under Event Number 52468.

CORRECTIVE ACTIONS

The power supply cable was replaced and post maintenance testing was completed satisfactorily. The preventative maintenance procedure will be revised to include a step to inspect connection pins and jacks when changing the firing assembly.

Additionally, the cable on the discharge valve for SLC subsystem A will be replaced and sent to FirstEnergy BETA Laboratory for analysis when the valve is replaced during the next refueling outage. The analysis will be used to determine if a new preventative maintenance task is necessary for periodic replacement of these cables.

PREVIOUS SIMILAR EVENTS

A review of LERs and the corrective action database for the past three years showed no similar events.