05000247/LER-2006-006
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2472006006R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within brackets { }
DESCRIPTION OF EVENT
On November 30, 2006, while in Hot Standby for an outage with both Main Boiler Feedwater Pumps (MBFPs) {SJ} isolated and secured, a local reset of the 21 MBFP turbine {TRB} resulted in an automatic actuation of both motor driven Auxiliary Feedwater Pumps (AFWP) {BA) and isolation of steam generator (SG) {AC) blowdown at approximately 1445 hours0.0167 days <br />0.401 hours <br />0.00239 weeks <br />5.498225e-4 months <br />.
On November 30, 2006, at approximately 0447 hours0.00517 days <br />0.124 hours <br />7.390873e-4 weeks <br />1.700835e-4 months <br />, the plant was shutdown to repair a leak on a drain pipe associated with SG blowdown. During the outage, a work activity was underway to troubleshoot the 21 MBFP turbine high pressure steam governor valve {V). The work scope included installation and adjustment of a new linkage arm and square washer to 21 MBFP turbine governor and performance of a valve hysteresis. A protective tagout (PTO) was implemented to support work on the 21 MBFP which initially removed high pressure turbine control oil from the 21 MBFP governor control system per maintenance request.
Prior to beginning work on the 21 MBFP, Maintenance determined that using control oil would be preferable during troubleshooting and requested a revised PTO. The revised PTO included isolation of the MBFP Lovejoy electro-pneumatic speed control system {JK} control air signal from the control room (CR) {NA).
The isolation closed the "High Gain" selector valve since the Work Package called for local manual control of the air signal during testing. A test and maintenance (T&M) tag was applied to the 21 MBFP reset switch in the CR. A pre-job brief was conducted which included Maintenance personnel and the Operations Field Support Supervisor (FSS). The Work Package did not include steps to reset the 21 MBFP from the CR or locally at the MBFP. However, the brief discussed that the Maintenance lead directing troubleshooting would request CR operators to reset the 21 MBFP when needed. CR operators were not involved in the pre-job brief. After corrective maintenance was completed, the Maintenance lead requested CR operators to reset the 21 MBFP at approximately 1445 hours0.0167 days <br />0.401 hours <br />0.00239 weeks <br />5.498225e-4 months <br />. CR operators attempted unsuccessfully to reset the 21 MBFP.
Subsequently, the Maintenance lead requested permission to reset the MBFP turbine locally. Misunderstanding that permission was provided, the Maintenance lead locally reset the 21 MBFP and an auto start signal was initiated for actuation of the AFWPs and isolation of blowdown. During the local reset of the 21 MBFP, the Maintenance lead observed the high pressure control oil pressure rise steadily to approximately 130 psig (expected). After reset, the Maintenance lead observed the MBFP governor valve open (unexpected).
Continuing work activities for troubleshooting the 21 MBFP required another reset of the 21 MBFP. At approximately 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br />, the CR attempted to reset the 21 MBFP and was unsuccessful. Using a revised Work Package, the 21 MBFP was successfully reset locally by a Nuclear Plant Operator (NPO) and no AFW actuation occurred. At 2046 hours0.0237 days <br />0.568 hours <br />0.00338 weeks <br />7.78503e-4 months <br />, the Maintenance lead requested the 21 MBFP to be reset from the CR. The CR reset attempt was again unsuccessful and an NPO was directed to reset the 21 MBFP locally. During the local reset of the 21 MBFP an AFW actuation occurred and blowdown isolation initiated at approximately 2100 hours0.0243 days <br />0.583 hours <br />0.00347 weeks <br />7.9905e-4 months <br />. During the local resets, the MBFP turbine governor valve was observed to open and pressure was observed in the control oil system although there should have been little or no pressure with control air isolated.
Operations assessed the condition and determined that control air was building up in the Lovejoy control air lines due to isolating the CR air signals [current to pressure (I/P) converters {CNV} provide a vent path for potential control air leakage]. The air pressure in the control lines was greater than the MBFP turbine latch permissive and prevented resetting the 21 MBFP from the CR. Work was stopped and the PTO revised to allow venting of control air. At 2118 hours0.0245 days <br />0.588 hours <br />0.0035 weeks <br />8.05899e-4 months <br />, the revised PTO was implemented and the High Gain selector valve opened.
Operator reset of the 21 MBFP from the CR was then successful. On December 1, 2006, at approximately 0230 hours0.00266 days <br />0.0639 hours <br />3.80291e-4 weeks <br />8.7515e-5 months <br />, troubleshooting the 21 MBFP was completed and the PTO cleared. At 0330 hours0.00382 days <br />0.0917 hours <br />5.456349e-4 weeks <br />1.25565e-4 months <br />, the 21 MBFP was started.
The MBFP Lovejoy control system uses a 4-20 ma signal generated in the CR to generate a local (MBFP) 3-15 psi instrument air (IA) {LD} signal that pneumatically throttles MBFP turbine control oil speed changer valves to generate a 20-60 psi control oil signal. A local IA regulator {RG) can also be used to generate a 3-15 psi IA signal in place of the CR signal for MBFP turbine control.
An IA isolation valve (High Gain selector valve) {ISV}, can be closed to isolate the IA control signal generated from the CR demand. During work' activities on November 30, 2006, the High Gain selector valve was isolated while Maintenance was stroking control valves via the local pneumatic regulator. A reset of a MBFP from the CR requires that all trips be clear, that the high pressure and low pressure stop valve limit switches be in the closed position, and IA control signal be less than 3 psig. On November 30, 2006, the pneumatic portion of the turbine control oil speed changer valves appears to have allowed IA to bleed into and pressurize the IA signal air line to at least 12 psi. This condition was concluded to be due to the High Gain select valve being closed and causing this section of IA signal tubing to be bottled up and becoming filled by air leakage from the power air side to control air side of MBFP turbine control oil speed changer valves. Because the IA control signal was greater than 3 psi, the permissive to reset from the CR was not made up. Once the High Gain select valve was opened, a relief path through the I/P converters was established and control air was at or below 3 psi, making up the permissive thereby allowing the MBFP CR reset to be successful. As a result of the plant shutdown, the MBFPs were tripped and secured. Following a trip of the MBFP turbine, the Autostop Oil System for the operation of the turbine steam governor and stop valves must be re-established. The overspeed trip valve is released on all trips and therefore must be reset in order to reset the turbine trip. To reset the MBFP, all electrical trips must be cleared except for the MBFP discharge valve not fully open trip which is blocked during the reset process. Once all electrical signals are cleared, the solenoid trip valve will close and autostop oil pressure can be re-established. The MBFP trip/reset switch must be reset to remove the auto start signal to the AFW pumps. When auto-stop oil pressure falls below its pressure limit, as monitored by a pressure switch {PS}, a signal is sent to open the solenoid trips allowing autostop oil to drain resulting in closure of the MBFP turbine governor and stop valves (MBFP trip). A trip of the 21 MBFP will cause an auto start of the AFWPs via pressure switch PC-1154S which senses MBFP turbine Autostop oil pressure.
On November 30, 2006, at 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br />, an eight hour non-emergency notification was made to the NRC (Log Number 43016) for an actuation of the AFW system under 10CFR50.72(b)(3)(iv)(A). In addition, on December 1, 2006, at 0151 hours0.00175 days <br />0.0419 hours <br />2.496693e-4 weeks <br />5.74555e-5 months <br />, an eight hour non-emergency notification update to the initial notification (Log Number 43016) was made to the NRC for an actuation of the AFW system under 10CFR50.72(b)(3)(iv)(A). The events were recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2006-06885 (AFW actuation at 1445 hours0.0167 days <br />0.401 hours <br />0.00239 weeks <br />5.498225e-4 months <br />) and CR-IP2-2006-06944 (AFW actuation at 2100 hours0.0243 days <br />0.583 hours <br />0.00347 weeks <br />7.9905e-4 months <br />).
The events were reported under 10 CFR 50.72(b)(3)(iv)(A) since at the time of the events, the actuation of the AFWS was presumed to be from a valid signal.
Further evaluation performed under the CAP has not definitively identified the cause for the signal being generated. Additional work during the cycle 18 refueling outage in the spring of 2008 will be required to verify whether the signal was valid or due to equipment malfunction.
CAUSE OF EVENT
The direct cause of the AFWP actuation was a signal from the 21 MBFP trip circuit as sensed by a pressure switch for the MBFP turbine control oil system. During local reset of the 21 MBFP, the turbine control oil was reset and Autostop oil pressure was observed to increase above the reset pressure limit but during the activity there was an unexpected actuation of the AFWPs. The AFWP actuation is postulated to have been caused by a malfunction of the 21 MBFP turbine Autostop oil pressure switch PC-1154S. While it is recognized that control air leakage past the 21 MBFP hydraulic speed control valve actuators in combination with control air isolation valve closed allowed pressure build up in the Lovejoy signal air lines preventing resetting from the CR of the MBFP turbine due to air pressure greater than the latch permissive setpoint, it is not as likely that this condition resulted in the AFWP actuation during the 21 MBFP reset.
The root cause of the event was proceeding without fully understanding the equipment response. During the valve stroke adjustment, when unexpected equipment responses were obtained, work continued without understanding the reasons for the equipment behavior and without a clearly communicated overview of risks and contingency plans. Procedure IP-SMM-OP-106, "Procedure Use and Adherence," includes a requirement to stop work when the procedure cannot be performed as written. Procedure EN-MA-101, "Control of Maintenance," requires notification of proper levels of management when concerns, problems or unexpected conditions arise during the performance of maintenance. The work plan was to reset the 21 MBFP from the CR as directed by the Maintenance lead for the troubleshooting. When the reset from the CR did not function, work/troubleshooting should have stopped and the cause of failure to reset from the CR determined. If work had stopped and the failure of the CR reset investigated and corrected, the AFWP actuation signal would not have occurred.
The corrective actions associated with the root cause and contributing causes are provided in the CAP (CR-IP2-2006-06885).
CORRECTIVE ACTIONS
The following corrective actions will be performed under the CAP to address the cause of this event and prevent recurrence.
- Work Order IP2-06-01604 was prepared to perform dynamic testing of pressure switch PC-1154S. Testing must be performed during an outage which is scheduled for the spring of 2008.
- Work Order IP2-06-01605 was prepared to perform Lovejoy testing for the 21 MBFP governor speed changer valves. Testing must be performed during an outage which is scheduled for the spring of 2008.
Any corrective actions identified as a result of the testing will be implemented as necessary in accordance with the CAP.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the AFWS.
This event is judged to meet the reporting criteria because the AFWS was actuated in accordance with design as a result of satisfying the requirements for initiation from the actuation circuitry from the 21 MBFP. In accordance with design when MBFP turbine control auto-stop oil pressure falls below its setpoint limit as monitored by a pressure switch, a signal is sent to actuate the AFWPs.
Twice on November 30, 2006, the 21 MBFP turbine control oil pressure as sensed by pressure control switch PC-1154S met the criteria for actuation of the AFWPs.
Although the validity of the signal is uncertain at this time (whether an equipment malfunction of the pressure switch resulted in the AFWP actuation), this event is being reported as an LER as verification testing exceeds 60 days.
As a result of this event no required safety system was unable to perform its safety function. Therefore, there was no condition reportable as a safety system functional failure under 10 CFR 50.73(a)(2)(v).
Past Similar Events
A review of the past two years of Licensee Event Reports (LERs) for events that involved an ESF actuation identified one LER. LER-2005-003 reported actuation of both motor driven AFW pumps due to the trip of the 22 MBFP on low lube oil pressure during swap of the in-service lube oil cooler. The cause of LER-2005- 003 was an inadequate procedure for venting the lube oil coolers. The cause of this LER was weak procedural guidance in the MBFP operating procedure. The corrective actions for this event were briefing operations and enhancement of the FW system operating procedure. The corrective actions for LER-2005-003 were revision of the system operating procedure for the MBFP lube oil system.
Therefore, those corrective actions would not have prevented this event.
Safety Significance
This event had no effect on the health and safety of the public.
There were no actual safety consequences for the event because the AFWS was in operation and the MBFPs were not aligned to deliver flow to the SGs. The SGs had adequate FW flow from the AFWS to maintain SG water level. Operators had alarms/indications alerting them to MBFP trip and actuation of the AFWS and procedures to direct proper actions. Operators during this event recognized the MBFP trip and took appropriate actions in accordance with plant procedures.
There were no significant potential safety consequences of this event under reasonable and credible alternative conditions. Loss of FW at full power is a credible alternative condition. This event would be bounded by the analyzed event described in FSAR Section 14.1.9, Loss of Normal Feedwater. A loss of one MBFP at power will result in a plant trip on low SG level if operator action does not correct the FW flow imbalance. A Low-Low water level in any one SG initiates actuation of two motor-driven AFW pumps and a Low-Low water level in any two SGs actuates the steam driven AFW pump. The AFW System has adequate redundancy to provide the minimum required flow assuming a single failure. The analysis of a loss of normal FW shows that following a loss of normal FW, the AFWS is capable of removing the stored and residual heat plus reactor coolant pump waste heat, thereby preventing either over pressurization of the RCS or loss of water from the reactor core and returning the plant to a safe condition.