05000247/LER-2008-002
| Uindian Point 2 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2472008002R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On March 27, 2008, with the unit shutdown for a refueling outage (Mode 5), a 480 V breaker {BKR} on Safeguards Bus 2A {ED} did not close during a surveillance test.
Troubleshooting on March 28, 2008, to evaluate this failure, while in Mode 6, identified a wiring problem with the 23 Fan Cooler Unit (FCU) {BK}. The SI logic train A {JE} had two relays (i.e., 3-2 and 3-3) {RLY} with wires associated with 23 FCU on terminal points associated with 480 V bus 5A (relay 3-3) rather than bus 2A (relay 3-2), the power supply for 23 FCU.
These relays act to sequence FCUs onto the bus following a loss of offsite power and have restraining contacts which prevent them from sequencing FCUs if there is an undervoltage signal on the bus. The SI logic train B had the same wiring issue associated with sequencing relays 3-12 and 3-13.
The identified wiring anomaly with a loss of offsite power and a single failure to power bus 5A, would result in less than minimum safeguards equipment because 21 FCU, 22 FCU, and 21 Containment Spray pump {BE} would not have automatically started per design (as well as preventing the automatic loading of 23 FCU).
Engineering review of drawings found discrepancies between the present schematics and the Rack G1 and G2 wire lists. Plant schematics show the desired configuration (i.e., relays 3-2 and 3-12 wired into the 23 FCU control circuit so they will only be restrained upon a loss of power to Bus 2A). The wire lists showed the as found conditions (i.e., connections for 23 FCU on relays 3-3 and 3-13, which are both associated with bus 5A). Westinghouse schematics 449B444 Sheet 47, Rev. 6 (1970) showed the as found condition while Revision 8 (1973) showed the desired condition.
Engineering concluded that an Engineering Change Notice (ECN) was made in accordance with the process in effect by the original installer (Westinghouse), to either Revision 7 (Westinghouse ECN-9642) or Revision 8 (Westinghouse ECN-9823), but not reflected on the wiring lists or in the as built plant.
The present surveillance tests for this circuitry (Periodic Test 2-PT-R013, "Safety Injection," and 2-PT-R014,"Automatic Safety Injection System Electrical Load and Blackout Test") would not have identified this wiring error since the relays in each logic train are normally actuated simultaneously. The purpose of the functional testing is to verify that the associated devices and circuits function, not to separately actuate individual relays to ensure that only the components associated with a particular relay actuated.
In 1996 the NRC issued Generic Letter 96-01, which required all nuclear plants ensure that all safety related logic including parallel contacts was tested.
The anomaly that occurred in the 23 FCU control circuit was not discovered while this program was being conducted because the evaluation was focused on ensuring that all safety related logic, including parallel contacts, was functionally tested. The nature of this wiring anomaly is that it is possible for all devices and contacts to be tested and the anomaly would still not be detected.
Cause of Event
The apparent cause of the event was an inadequately processed engineering design change (ECN) by the original installer in 1973, which did not revise wiring diagrams used to install wiring for the control circuits associated with 23 FCU. The apparent contributing cause was the failure to adequately test the circuitry induced by the failure to change the wire lists during preoperational testing. The details of the event are not recoverable due to the passage of time.
Corrective Actions
The following corrective actions have been performed under Entergy's Corrective Action Program to address the cause and prevent- recurrence:
- The appropriate relay contacts for 23 FCU were re-wired in accordance with re-verified design documents and satisfactorily tested.
- An extent of condition inspection was performed and no additional wiring anomalies were identified.
- The process at IPEC was assessed for the same potential. The Entergy Nuclear engineering change (EC) and engineering change notice (ECN) process, as described in EN-DC-115 "Engineering Change" and EN-DC-116 "Engineering Change Installation" require review and design verification (if safety related) of all documents. All affected active drawings are marked-up and provided to the installer including wiring diagrams as well as schematics.
The installers work to wiring drawings, while testing normally is developed using schematics. As such, this usually provides a cross check between the two types of drawings. EN-DC-117 "Post Modification Testing and Special Instructions" requires that modifications be tested "under all configurations, even those which may not "normally" be expected to occur.
This includes testing all functions of the affected portion of the system.
The Return to Service and Closeout process of EN-DC-118, 'Engineering Change Closure', provides a check that all installation and testing requirements have been met prior to placing the modified equipment back into service.
Event Analysis
The event is reportable under 10 CFR 50.73(a)(2)(i)(B), operation or condition which is prohibited by the plant Technical Specification (TS). TS 3.3.2, requires Safety Injection, Automatic Actuation Logic and Actuation Relays to be OPERABLE in modes 1, 2, 3 & 4. The required relays were not operable since they would not have performed their required function assuming a single failure of one diesel to supply power to bus 5A and loss of offsite power during a design basis accident. In this scenario bus 2A is available but the associated 23 FCU can not receive an automatic start as a result of its actuating relay being restrained due to no power to bus 5A.
The relays automatically actuate the Fan Cooler Units. TS 3.6.6, "Containment Spray System and Containment Fan Cooler Unit (FCU) System," LCO requires two trains of containment spray and three trains of FCUs OPERABLE in modes 1, 2, 3 & 4. The required FCU trains would not have performed the required function assuming a single failure of one diesel to supply power to bus 5A and loss of offsite power during a design basis accident. In this scenario the 5A train is unavailable and the 2A train is degraded since the 23 FCU does not receive a start. The 23 FCU is however available for manual start.
No safety system functional failure (SSFF) occurred. A SSFF could occur if all power was lost to bus 5A. This would result in no power to the 21 and 22 FCU as well as the 21 Containment Spray Pump. It would also result in relay 3-3 and 3-13 not actuating the 23 FCU on bus 2A. No SSFF has occurred because there has been no reported loss of offsite power to bus 5A concurrent with a failure of the capability to power bus 5A with its assigned EDG during times applicable safeguards equipment were required to be operable. In accordance with the guidelines of NUREG-1022, an additional random single failure does not have to be assumed in that system for reportability.
PAST SIMILAR EVENTS
A review was performed of Licensee Event Reports (LERs) for the past three years for any events that involved mis-wiring of logic relays or loss of emergency bus. No LERs were identified that reported similar failures.
SAFETY SIGNIFICANCE
This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents requiring the affected safety equipment during the time of the anomaly.
However, if an event had occurred with the condition mentioned above (loss of bus 5A), then minimum safeguards equipment would not have automatically started as required by design. The option for FCU manual start was always available to mitigate the consequences of this postulated scenario. A risk assessment evaluated the condition with 23 FCU breaker out of service and determined there is no measureable impact on Core Damage Frequency (CDF).
The incremental CDF change of 1.38E-8 events per year resulted in a CDF of 1.7887E-5 events per year from a CDF of 1.7874E-5 events per year.