05000263/LER-2015-002

LER-2015-002, Loss of Shutdown Cooling Due to Improperly Landed Jumper Wire

Monticello Nuclear Generating Plant
Event date:	05-02-2015
Report date:	08-20-2015
Reporting criterion:	10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat
2632015002R01 - NRC Website

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

EVENT DESCRIPTION

On May 2, 2015, the Monticello Nuclear Generating Plant (MNGP) was in Mode 5 (Refueling) at 0% thermal rated power with the vessel [RPV] cavity flooded. Shutdown cooling (SDC) was being provided by the 12-Residual Heat Removal (RHR) Pump [P] and the 12-RHR Service Water (SW) System [BI] powered by Bus-16 (Division 2-4kV Essential Bus) [BU].

At 1247 hours0.0144 days <br />0.346 hours <br />0.00206 weeks <br />4.744835e-4 months <br />, the MNGP experienced a loss of power to Bus-15 (Division 1-4kV Essential Bus) and LC- 103 (Division 1-480V Essential Load Center) during calibration of Bus-15 relays [RLY]. A human performance error occurred during the surveillance when a jumper wire was installed across the incorrect terminals.

The loss of LC-103 resulted in a loss of power to MCC-133A (Division 1-480V Essential Motor Control Center) [MCC] which powers the position indication for the RHR SDC Inboard Isolation Valve [ISV]. The valve position indication was de-energized, resulting in 12-RHR pump control logic to interpret the loss of position indication as a closed valve. Loss of detection of a viable suction flow path by 12-RHR pump control logic caused a subsequent trip of the 12-RHR pump and a loss of SDC, even though the pump was powered by Bus-16. Immediately following the event, abnormal procedures were entered and all work suspended pending approval of the shift manager.

At 1300 hours0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br /> the Fuel Pool Cooling and Cleanup (FPCC) System [DA] and natural circulation were verified as an alternate decay heat removal source and hourly reactor coolant temperature monitoring was initiated per required actions of Technical Specification (TS) Limiting Condition for Operation (LCO) 3.9.7, "Residual Heat Removal (RHR) — High Water Level.

At 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br />, power was restored to LC-103 when it was cross-tied with LC-104 (Division 2-480V Essential Load Center), restoring power to the RHR SDC Inboard Isolation Valve.

At 1602 hours0.0185 days <br />0.445 hours <br />0.00265 weeks <br />6.09561e-4 months <br />, 12-RHR Pump was placed back into service restoring normal SDC. The 12-RHR Pump was unavailable for approximately 195 minutes causing the RHR Heat Exchanger [HX] inlet temperature to increase approximately 10 degrees F to 91.1 degrees F. Reactor Pressure Vessel (RPV) water temperature was maintained within the established temperature band throughout the duration of the event.

EVENT ANALYSIS

At the time of the event, decay heat was being removed by the 12-RHR pump and the 12-RHR SW System. The vessel cavity was fully flooded above the top of the RPV flange with the Spent Fuel Pool gates [GATE] removed. Since the RHR SDC Inboard Isolation Valve provides common suction to all RHR pumps, loss of position indication of the valve caused all trains of RHR to be unavailable for decay heat removal function. Reactor Water Cleanup (RWCU) System [CE] was also unavailable due to planned maintenance activities. Therefore, following the loss of normal SDC, decay heat removal function was supported by a single FPCC pump.

The event was determined to be reportable in accordance with 10 CFR 50.73(a)(2)(v)(B) as an Event or Condition that Could have Prevented the Fulfillment of the Safety Function of Structures or Systems that are Needed to Remove Residual Heat. This event is considered a Safety System Functional Failure per NEI 99-02 Revision 7.

SAFETY SIGNIFICANCE

With the unit in Mode 5, the RHR SDC System is not required to mitigate any events or accidents evaluated in the safety analyses. The RHR SDC System is required for removing decay heat to maintain the temperature of the reactor coolant.

The decay heat load was within the calculated capacity of a single FPCC pump to maintain safe shutdown of the plant. This was demonstrated by coolant temperatures remaining within the established band throughout the duration of the event. Heat up calculations were performed and determined it would take approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or longer to reach the 125 degrees F required to maintain a reasonable working environment in the pool area and keep the demineralizer system at an operable temperature. However, operation at temperatures up to 140 degrees F is acceptable to remove decay heat from the spent fuel pool. Maximum coolant temperatures were conservatively calculated to remain less than 141 degrees F while a single FPCC pump provided decay heat removal. Since shutdown cooling was restored promptly after the event occurred, coolant temperatures were maintained well below the limiting design thresholds of the FPCC system and upper limit of the established band. The safety significance of this event was minimal and there were no consequences that affected public health and safety.

CAUSE

The direct cause was determined shortly after the event occurred. During surveillances that were performed on Bus-15 relays, a technician improperly landed a jumper wire across the incorrect terminals and caused a "no voltage" signal to trip the bus power supply breaker. The direct cause of the human performance error was inadequate use of concurrent verification techniques as the transmission and distribution (TD) personnel did not have a correct understanding of what a concurrent verification was and instead attempted a peer check. This was not effective because the physical environment created an error precursor as the terminal strip was located in a tight space that complicated the concurrent verification process. The verifier failed to recognize the performer miscounted down the terminal strip to the inappropriate terminal. Expectations for use of flagging techniques and removal of dust covers to view terminal numbers for hard match were not performed by TD personnel prior to performing surveillances.

The root cause of the event was that RHR SDC was not hardened sufficiently to prevent a human performance error from causing a loss of SDC. The Division II SDC cross train vulnerability was not identified and addressed during multiple assessments involving outage planning, shutdown safety, and decay heat removal hardening. Operations failed to implement effective barriers for preventing loss of Bus-15 and subsequent loss of SDC. This was the result of failing to apply robust protection strategies using available information during the decay heat removal hardening assessment.

Inappropriate risk classification of the work order (WO) task for the surveillance procedure contributed to this event. The work order task was classified as normal risk in March of 2012, which was consistent with the risk screening process in place at the time of its creation. In February of 2013, the risk screening process was revised. However, no process requirement existed to drive review and revision of previously approved model work orders (MWOs) when relevant assessment criteria change. Also, the integrated risk management procedure does not require repetitive tasks to be re-evaluated if the frequency of performance is less than or equal to two years. As a result, additional work controls demanded for high risk activities were not invoked for this WO task. The organization did not recognize and take action to address the risk that changing requirements might have on previously reviewed MWOs.

CORRECTIVE ACTION

Immediate corrective actions included suspension of all work pending approval of the shift manager to ensure outage activities did not further degrade plant conditions and electrical work was limited to protect SDC. SDC was restored by cross tying LC-103 to LC-104 using approved plant procedures. The MWO was revised to document nuclear safety risk as High.

Corrective actions addressing the root cause of the event and designed to prevent recurrence include revision to the SDC Division II protected system ticket checklist to include MCC-133, LC-103 and associated control switches, as well as Bus-15 control switches when LC-103 is powered by Bus-15. The operations manual for the RHR system will be revised to include precaution of the cross train power vulnerability and the impact if not bypassed or cross tied. An effectiveness review will be conducted to ensure all corrective actions have been properly implemented/documented, precluded recurrence of this event, and did not result in unintended or adverse consequences.

Corrective actions to address the human performance errors include revision of procedures to clarify when the use of flagging methods, hard matches of equipment identifications, and concurrent verification is required during lifting/landing jumpers or leads. A "What it Looks Like" form will be established to reinforce human performance tools used during lifting/landing jumpers and leads.

Corrective actions to address WO risk classification include clarifying the risk assessment worksheet requirements for activities which could result in loss of electrical distribution components and revising procedures to clarify requirements for cross-tying load centers when SDC is in service. Risk analysis of safety related or technical specification related surveillances and preventative maintenance tasks will be performed to ensure proper risk classification is assigned.

Corrective actions to address the extent of condition and cause included revision of procedures to clarify protected equipment requirements for the FPCC and RWCU systems. Single point vulnerability studies will be performed and formalized for the RHR SDC, FPCC, and RWCU systems.

PREVIOUS SIMILAR EVENTS

There was one previous similar event in the past three years captured in LER 2013-004, "Loss of Normal Off-Site Power as a Result of Switchgear Fault," where shutdown cooling was lost due to loss of AC power.

This event was not caused by a human performance error; therefore corrective actions as a result of this event would not have prevented loss of shutdown cooling reported in this LER.

ADDITIONAL INORMATION

The Institute of Electrical and Electronics Engineer codes for equipment are denoted by [XX].