05000250/LER-2014-005

LER-2014-005, Manual Reactor Trip Due to Loss of Instrument Air

Turkey Point Unit 3
Event date:	8-11-2014
Report date:	10-10-2014
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
2502014005R00 - NRC Website

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

- NARRATIVE

2. DOCKET

On August 11, 2014 at approximately 1028 hours0.0119 days <br />0.286 hours <br />0.0017 weeks <br />3.91154e-4 months <br /> with Unit 3 at approximately 100% reactor power, a manual reactor [AC, RCT] trip was initiated in response to a loss of instrument air (IA) [LD]. The Auxiliary Feedwater (AFW) System [BA] automatically initiated as designed. The unit was subsequently stabilized in Mode 3 with IA restored.

At the start of the event the electric driven 3CM IA compressor [LD, CMP] was operating with diesel driven 3CD and 4CD IA compressors available in standby. When the 3CM IA compressor unloaded and IA pressure lowered, Operations personnel attempted to load the available IA compressors which started automatically but failed to load. The reactor operator manually tripped the reactor in acccordance with procedure when air pressure lowered below 65 psig, and then entered the reactor trip response procedure.

Operations personnel had been able to stop, restart and load the 4CD IA compressor, and IA system pressure recovered to normal values prior to reaching the manual trip value of 65 psig on Unit 4.

Operations personnel isolated IA to containment [NH] due to a perception that there was an IA leak in containment. IA to containment was isolated for approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. With IA to containment isolated Reactor Coolant System (RCS) letdown isolation valves [AB, CB, ISV] closed and pressurizer [AB, PZR] sprays were unavailable complicating pressurizer pressure and level control. The operating crew initiated a controlled cooldown to assist in maintaining pressurizer level. With reactor pressure above 2000 psig, a safety injection (SI) [BQ] signal could not be blocked. An automatic SI actuation occurred as a result of main steamline [SB, PSP] high differential pressure when RCS temperature was reduced to approximately 470°F. High head safety injection (HHSI) pumps [BQ, P], residual heat removal (RHR) pumps [BP, P], and emergency diesel generators (EDG) [EK, DG] automatically started as designed due to the SI signal. Based on plant conditions (RCS pressure approximately 2050 psig), the HHSI and RHR pumps did not inject into the RCS.

Event Notification No. 50354 was made to the NRC Operations Center in accordance with 10 CFR 50.72(b)(2)(iv)(B) for a valid actuation of the reactor protection system (RPS) while critical and 10 CFR 50.72(b)(3)(iv)(A) for valid Engineered Safety Feature (ESF) actuations of AFW, SI, and EDGs. This report is in accordance with 10 CFR 50.73(a)(2)(iv)(A) due to valid actuations of the RPS, AFW, SI and EDGs.

CAUSES OF THE EVENT

The electric driven 3CM IA compressor unloaded when the 'load' pushbutton on the liquid crystal display (LCD) control panel [LD, PMC, PL] was depressed in error during an operator round and the standby diesel driven IA compressors started but did not load.

The root causes are:

• A latent design error in programmable logic controller (PLC) [LD, PMC] coding which prevented the APPROVED BY OMB: NO. 3150-0104 EXPIRES: 01/31/2017 Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-1 0202, (3150-01 04), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

• The design error was due to overreliance on the vendor to provide a complex digital modification without adequate in-house review.

Contributing causes include difficulty in reading the 3CM LCD control panel screen [LD, PMC, PL, SCN] in direct sunlight and lack of control panel screen instructions or operator aid.

The SI actuation was caused by inadequate control of primary plant parameters during the loss of IA to containment. The root cause of the SI actuation was inadequate procedural guidance for responding to a loss of IA to containment.

ANALYSIS OF THE EVENT

Loss of Instrument Air During rounds the turbine plant operator could not see the control panel display on the running electric driven compressor, 3CM. The operator pressed what was thought to be the administrative button to get the screen to a different mode. The load button was pressed instead causing the compressor to unload.

The control panel is difficult to view in direct sunlight. In addition, instructions for operating the CM IA compressor control panels were not readily available during the operator rounds.

At approximately 1020 hours0.0118 days <br />0.283 hours <br />0.00169 weeks <br />3.8811e-4 months <br />, the Operations personnel in the control room acknowledged the IA low pressure annunciator and directed immediate operator action to start all available IA compressors.

The diesel driven 3CD and 4CD IA compressors are designed to be backup sources for the electric driven compressors (CM). As backups, the compressors are placed in 'Normal' standby operation which bypasses all safety trip and shutdown protections to ensure that the compressors function and supply air when needed. If the diesel driven compressors experience trouble, an alarm will be activated giving Operations personnel time to resolve the problem. The standby feature is unique to the diesel compressors.

As configured at the time of the event it was expected that the 4CD and 3CD IA compressors would automatically start and load when IA system pressure dropped below the identified setpoint. Instead, system pressure continued to drop and both the 3CD and 4CD compressors were found running unloaded in a non-responsive state. Several attempts to take local control of the compressors and load were not successful. Ultimately, operators had to employ an Emergency Stop and locally start them in order to load and supply IA to the system. Both diesel driven IA compressors were restarted and loaded by approximately 1029 hours0.0119 days <br />0.286 hours <br />0.0017 weeks <br />3.915345e-4 months <br />; however, the IA pressure decreased below 65 psig for Unit 3 which required the manual reactor trip.

A cooling fan permissive in the PLC coding, not needed for standby operation, rendered the compressors in a non-responsive state requiring an Emergency Stop to exit the code and allow manual operation. The vendor supplied compressor software was not subject to a detailed technical review by in-house personnel APPROVED BY OMB: NO. 3150-0104 EXPIRES: 01/31/2017 Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. It a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

IA to containment remained isolated for approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The letdown isolation valve closed, complicating pressurizer level control. The pressurizer spray valves also closed, resulting in rising pressurizer pressure. RCS pressure remained above the point for blocking an SI signal - 2000 psig. While the operating crew were aware of a caution in the procedure in use to not allow steam generator (SG) [SB, SG] pressure to go below 500 psig until SI was blocked, SG pressure decreased and SI actuated on main steam line differential pressure. Main steam line differential pressure initiates when SG pressure is 100 psig less than main steam line header pressure, because it is designed to provide protection from an upstream steam line break. Because RCS pressure remained higher than the shutoff head of the HHSI pumps, the SI actuation did not result in an injection to the RCS.

ANALYSIS OF SAFETY SIGNIFICANCE

All control rods inserted upon the reactor trip. AFW initiated as expected by plant design. Although complications arose during plant cooldown with pressurizer pressure and level control due to isolation of IA to containment that resulted in SI actuation, SI injection was not required and did not occur. SI actuated equipment was restored to standby status and the unit stabilized in Mode 3. Therefore, safety significance was minimal.

CORRECTIVE ACTIONS

Corrective action is in accordance with condition reports AR 1983607 and 1983618 and include:

1. A jumper was installed within both the 3CD and 4CD compressors to ensure that the cooling fan permissive is always enabled.

2. Initiate modification to correct the design error within the PLC coding.

3. Provide operator aid for control panel functions when performing rounds.

4. Revise loss of IA procedure to provide guidance for controlling primary plant parameters when IA is lost to containment.

Other Action A fleet Digital Design Guide based on INPO Good Practice 10-008, "Ensuring Engineering Quality in Digital System Projects," and procedural guidance establishing the level of in-house review required for vendor contracted modifications had been developed and implemented subsequent to the design of the new compressors.

APPROVED BY OMB: NO. 3150-0104 EXPIRES: 01/31/2017 Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

component function identifier (if appropriate)].

FAILED COMPONENTS IDENTIFIED: None.

PREVIOUS SIMILAR EVENTS: None in the last five years.