05000333/LER-2008-001
| Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. N/A | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| Initial Reporting | |
| ENS 44492 | 10 CFR 50.72(b)(3)(v)(B), Loss of Safety Function - Remove Residual Heat |
| 3332008001R00 - NRC Website | |
BACKGROUND
The Primary Containment Isolation System (PCIS) [EIIS=JM] initiates automatic isolation of appropriate process lines which penetrate the primary containment whenever monitored variables exceed preselected operational limits.
The Residual Heat Removal System (RHR) [EllS=B0] removes decay heat from the reactor core when the plant is in the refueling mode (Mode 5). RHR Shutdown Cooling (SDC) Inboard Isolation Valve, 10MOV-18 [EIIS=ISV], isolates the common shutdown cooling suction line to all RHR pumps [EllS=P]. With the "B" RPS system de-energized removal of fuse 16A-F15 [EIIS=FU] completely de-energizes power to PCIS Logic Relay 16A-K29 [EIIS=86] resulting in closure of 10MOV-18.
EVENT DESCRIPTION
On September 16, 2008 at 0734, while the James A. FitzPatrick Nuclear Power Plant (JAF) was shutdown, in Refueling Mode (Mode 5), with cavity flood-up in progress, a fuse (16A-F15) was removed during an equipment tag-out evolution that resulted in the closure of two PCIS valves that resulted in a loss of SDC to the reactor core.
The tag-out was being performed on a portion of the Reactor Protection System (RPS) [EIIS=JC], PCIS circuitry, to support relay replacement activities. When removing fuse 16A-F15 as directed by the tag-out, isolation logic for the RHR SDC Inboard Isolation Valve, 10 MOV-18, and Recirculation Loop Inboard Sample Isolation Valve 02-2AOV-39 [EIIS=ISV] actuated. Closure of the SDC Inboard Isolation valve isolates the common shutdown cooling suction line to all RHR Pumps, thereby isolating SDC to the reactor core. At the time of the isolation, the time to boil was greater than 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
Immediately following the event, Operators restored power to the RPS, restored SDC and suspended further work in the system pending the results of an investigation into the cause of the event. Additional controls were established that included a review of all electrical jumper / protective tagging interactions specified in the remaining work activities prior to installation.
The event was reported to the NRC Operations Center as EN# 44492 via the Emergency Notification System pursuant to 10 CFR 50.72(b)(3)(v) for loss of SDC (8-hour report). The event also requires written NRC notification within sixty (60) days in accordance with 10CFR50.73(a)(2)(iv), "Any event or condition that resulted in manual or automatic actuation of ...(B)(2) General containment isolation signals affecting containment isolation valves in more than one system ... and, 10CFR50.73(a)(2)(v), "Any even or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to, ...(B) Remove residual heat.
EVENT ANALYSIS
The RPS system response and logic circuits functioned as designed. The event resulted in isolation of two primary containment isolation valves and loss of shutdown cooling. Both systems were quickly restored and had minimal impact on overall plant safety.
CAUSE OF EVENT
The cause of the event was ineffective implementation of the outage risk assessment procedure. The 'B' RPS tag-out was intended to be implemented while RHR Shutdown Cooling was not required to be in service and the DHR system was in service. When the work task was relocated from the SDC outage to a period in which SDC would be in service the outage risk assessment team failed to identify the potential impact of hanging the "B" RPS tag-out on plant conditions.
EXTENT OF CONDITION
The inadvertent actuation of a safety system (PCIS Group II Isolation) while performing a tag-out evolution could occur in any work task associated with a plant safety system.
FAILED COMPONENT IDENTIFICATION
There were no component failures as a result of this event. The event was caused by human error due to ineffective implementation of the Outage Risk Assessment Procedure.
CORRECTIVE ACTIONS
Immediate Corrective Actions:
1. Restored power to the affected portion of the RPS.
2. Restored SDC within 53 minutes.
3. Suspended further work in the RPS system pending the results of an investigation into the cause of the event.
4. Established additional controls to prevent recurrence of this event, including a review of all electrical jumper / protective tagging interactions specified in remaining work activities prior to installation.
Completed Corrective Actions:
1. Performed a Root Cause Analysis.
2. Performed a Human Performance Error Review.
3. Performed a Plant Impact Assessment for all tag-outs that were installed from 09/21/08 to the completion of the refuel outage (R18) that involved pulling fuses and/or lifting leads. Additional emphasis was provided on tag-outs affecting protective logic circuitry.
4. All surveillance tests categorized as "High Risk Activity" that were found to contain additional controls were classified as an Infrequently Performed Tests and Evolutions (IPTE) and controls required by the IPTE governing procedure (EN-OP-116) were implemented as appropriate to provide additional oversight.
5. Provided special consideration when determining risk assessments to address the potential configuration when a half isolation signal is present, similar to having one train of SDC available, with contingencies developed that address single point failures on the other isolation logic circuitry.
6. Addressed risk reviews for emergent work with additional rigor.
7. Evaluated plant procedures to ensure that specific components necessary to protect SDC are identified for administrative controls.
Planned Corrective Actions:
1. Upon completion of the Root Cause investigation, this event will be shared with the industry through the INPO Operating Experience Program.
2. A benchmark will be performed on SDC procedures from Vermont Yankee, River Bend Station, and Nine Mile Point Unit 2 as appropriate, to incorporate best industry practices into JAF site specific procedures.
3. Evaluate for potential enhancements, JAF procedures relating to equipment tag-out and protected equipment administrative controls and performance of risk assessment reviews for plant impact.
ASSESSMENT OF SAFETY CONSEQUENCES
The event began on September 16, 2008 at 0734 and was terminated within 53 minutes at 0827 after restoration of SDC. During the period that SDC was isolated, the reactor was shutdown in Mode 5 for refueling, cavity flood-up was in progress and the time to boil was greater than 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The reactor water temperature at the onset of the event was 100°F and 108°F upon restoration of SDC. The resulting increase of 8°F did not significantly alter plant conditions.
There were no nuclear, radiological or industrial safety consequences associated with the event. All systems performed as designed and there were no component or system failures. In the event that the RHR pumps could not be restarted, an alternate train of redundant RHR pumps was available for SDC. In the event that the SDC suction isolation valves would not open from the control room, manual re-opening of the valves could have been performed if directed by the shift manager. Therefore, barriers providing safety to the public were not compromised and the safety significance of this event is considered low.
SIMILAR EVENTS
No similar events at JAF have occurred during the past ten (10) years.
REFERENCES
JAF Condition Report CR-JAF-2008-02997, SDC Isolation While Hanging PTR