05000247/LER-2002-001

LER-2002-001,

Docket Number
Event date:	01-06-2002
Report date:	03-01-2002
Reporting criterion:	10 CFR 50.73(a)(2)(ii) 10 CFR 50.73(a)(2)(v), Loss of Safety Function
2472002001R00 - NRC Website

FACILITY NAME (1)

DOCKET

(I

SEQUENT REVISI

IAL � ON LER NUMBER6)

PLANT AND SYSTEM IDENTIFICATION

Westinghouse 4-Loop Pressurized Water Reactor

EVENT IDENTIFICATION

While Preparing for Maintenance Activities Personnel Error Results in Two Emergency Diesel Generators Inoperable

EVENT DATE

January 6, 2002

REFERENCES

Condition Reporting System Number: 200200192

EVENT DESCRIPTION

On January 6, 2002, at approximately 1730 hours0.02 days <br />0.481 hours <br />0.00286 weeks <br />6.58265e-4 months <br />, while performing an independent verification of tagging operations prior to planned maintenance activities on 23 Emergency Diesel Generator (EDG), an individual performing the verification mistakenly actuated the overspeed trip lever for 21EDG. This condition resulted in the unavailability of both 21 and 23EDGs, and placed the plant in a shutdown action statement per Technical Specification 3.0.1. The individual immediately recognized the error, and initiated corrective actions to restore 21EDG to operable condition. Control room personnel were immediately aware of this condition having received a "Diesel Generator Trouble" alarm actuation. The overspeed trip lever was reset, the alarm was cleared, and 21EDG was returned to operable status in less than five minutes.

The action statement of Technical Specification 3.0.1 was subsequently exited.

23EDG remained inoperable as initially intended for maintenance activities.

With 23EDG unavailable the limitations of Technical Specification 3.7.B.1.a remained in effect. At the time, the plant was at 100 percent power, and normal offsite power feeders were available. No injuries to plant personnel, damage to any equipment, or adverse safety implications to the public occurred as a result of this event.

FACILITY NAME (1)

DOCKET

(-I

SEQUENT REVISI

tAL � ON LER NUMBER6) PAGE (3 ) EVENT DESCRIPTION (Continued) The EDG system is designed such that any two of the three dedicated power trains are capable of supplying the minimum engineered safety features loads, assuming the single failure of one power train or EDG. This report is submitted pursuant to 10 CFR 50.73(a)(2)(v) as a condition that alone could have prevented the fulfillment of the safety function of a structure or system needed to mitigate the consequences of an accident, and 10 CFR 50.73(a)(2)(ii) as a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety. At the time, it was believed that no notifications pursuant to 10 CFR 50.72 were necessary, because although two EDGs were unavailable, one EDG power train would have been adequate to provide power for a safe and orderly plant shutdown in the event of a loss-of-offsite electrical power. Subsequent review determined that a single EDG power train would not have been adequate under design basis accident conditions.

EVENT ANALYSIS

The expectations and requirements for conducting independent verifications are identified in Operations Administrative Directive (OAD)-6, "Equipment Status Control." These requirements were recently revised such that those individuals performing independent verifications could not participate in the specific equipment tagout activities. Furthermore, concurrent verification while tagging out equipment is not acceptable. Thus, it is expected that independent verifications be conducted upon the completion of the specific tagout activities.

As part of the tagout activities for 23EDG, a Nuclear Plant Operator (NPO) was directed to disable the auto start capability of the EDG by setting its overspeed trip lever to the tripped position. This was performed by the NPO as expected, and confirmed via illumination of the local control panel indication light. The position of the EDG overspeed reset lever is also an observable indication of the tripped status of the engine. Upon completion of the aforementioned tagout activities, the individual performing the independent verification wanted to confirm the status of 23EDG and proceeded to pull the overspeed lever; however, the overspeed trip lever on 21EDG was mistakenly actuated. The cause for this event is human performance related has been attributed to:

1. Inadequate implementation of self-checking techniques such as "STAR.

2. Misunderstanding of the appropriate method to confirm and verify component positions during independent verifications.

3. Lack of component labeling sufficient to create a mental barrier preventing crossing over to active systems or trains.

With the exception of 23EDG having been declared inoperable, there were no other structures, systems, or components which were inoperable at the start of the event and that contributed to the event.

FACILITY NAME (1)

DOCKET

(1

IAL I ON

LER NUMBER6) PAGE (3 ) 10 CFR 50.72 Notification This event is reportable pursuant to 10 CFR 50.72(b)(3)(v)(D) as, "Any event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident." However, at the time, it was believed that no notifications pursuant to 10 CFR 50.72 were necessary, because although two EDGs were unavailable, one EDG power train would have been adequate to provide power for a safe and orderly plant shutdown in the event of a loss-of-offsite electrical power. Upon further review it was determined that a single EDG power train would not have been adequate under design basis accident conditions. In hindsight, an eight-hour report notification pursuant to 10 CFR 50.72(b)(3)(v) was warranted.

EVENT SAFETY SIGNIFICANCE

This event was potentially significant because it resulted in the unavailability of two of the three EDGs. The design basis of the EDG system assures that any two of the three power trains and dedicated EDGs are capable of supplying the minimum engineered safety feature loads, assuming a single failure of one power train or EDG. However, because the actual time period that both EDGs were unavailable was no greater than five minutes, this event had minimal actual safety implications. The unavailability of the two EDGs for the brief period of time prior to restoration of 21EDG resulted in an incremental core damage probability (ICDP) of approximately 6E-9.

CORRECTIVE ACTIONS

Immediate corrective actions taken were to reset 21EDG's overspeed trip lever, clear the trouble alarm, and return 21EDG to operable status. As a result of this event, the following corrective actions have been, or will be implemented.

1. Each Shift Manager will review this event, its safety significance, and re- enforce the need to utilize self-checking techniques with their operating crews. (Completed) 2. Upgrade labeling of the EDGs. (Due Date: May 15, 2002) 3. Evaluate the adequacy of labeling on other similarly located equipment.

(Due Date: May 15, 2002) 4. Revise procedures as necessary to require the use of barrier tape as an aid to restrict access to operable equipment whenever work activities involve closely located similar equipment. (Due Date: May 15, 2002)

DOCKET

Indian Point, Unit 2 05000247

SEQUENT REVISI

IAL � ON

PREVIOUS OCCURRENCES

A review of previous occurrences that involved the same underlying concern or reason (i.e., human performance, component operation related) as this event was performed. Three events were identified, and reported to the NRC in the following LERs:

surveillance testing of 480 volt Bus 3A undervoltage relays, a technician performing the test was required to hold a switch in the bypass position while two test buttons were being pressed. That particular switch was not held in the "test" position as required by procedure, resulting in a trip of the breaker feeding the bus under test and the autostart of the EDGs.

implementation of a temporary facility change, maintenance personnel incorrectly disconnected wires from the load side of a fuse instead of the line side. This rendered control of the Bus 2A supply and load breakers inoperable for approximately one minute. During this interval, Bus 2A degraded voltage actuation channels were inoperable due to lack of 125 volt DC power.

maintenance activities, a mechanic working on 480 volt Breaker 52/2AT5A inadvertently depressed the trip button for Breaker 52/2AT3A. This inadvertently de-energized 480 volt Bus 3A, which actuated the undervoltage logic automatically starting the EDGs.