05000247/LER-2009-002
| Indian Point 2 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2472009002R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On April 3, 2009, at approximately 11:36 hours, while at 100% steady state reactor power, Control Room Operators initiated a manual reactor trip (RT) {JC} as a result of observing decreasing steam generator (SG) levels following loss of the 21 Main Boiler Feedwater Pump (MBFP), a large steam flow to feedwater (FW) {SJ} flow mismatch, and failure of the main turbine to automatically runback. All control rods {AA} fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}.
There was no radiation release. The Emergency Diesel Generators {EK} did not start as offsite power remained available. The Auxiliary Feedwater System {BA} automatically started as expected due to SG low level from shrink effect. While stabilized, a gland steam regulator failed requiring the shift of decay heat removal from the condensers to the atmospheric dump valves. On April 3, 2009, at 13:40 hours, a 4-hour non emergency notification was made to the NRC for an actuation of the reactor protection system while critical and included an 8-hour notification under 10CFR50.72(b)(3)(iv)(A) for a valid actuation of the AFW System (Event Log # 44967).
The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2009-01179. A post trip evaluation was initiated following the trip and completed on April 4, 2009.
Following the RT an investigation of the event removed the 21 MBFP front standard oil enclosure cover and discovered an autostop oil tubing {TGB} to Swagelock fitting failure on the MBFP autostop oil header. The tubing showed a fracture behind the back ferrule swage. The tubing is installed in an oil reservoir with oil in the tubing.
This failure impacted the auto stop oil system whose function is to immediately shut down the MBFP turbine upon occurrence of a trip signal. Because this oil supply incorporates an orifice, auto stop oil header pressure decreased rapidly to the 21 MBFP low auto stop header trip point resulting in a trip of the 21 MBFP. The auto stop oil system serves as a hydraulic link or interlocking arrangement between the MBFP turbine protective devices and the control devices that regulate the MBFP turbine steam admission valves. High pressure oil is supplied to the high pressure and low pressure MBFP steam stop valve servomotors via orifices with a connection downstream of each orifice to drain via an autostop oil pilot operated trip valve. Two redundant trip solenoid valves (normally de-energized and closed) are provided on connections to the autostop oil header. When actuated, these solenoid trip valves relieve autostop oil pressure resulting in the closure of valves and stopping the supply of steam to the MBFP turbine.
The tubing and Swagelock fitting were part of a modification in 1986 that installed a Lovejoy Speed Control System {JK} for the MBFPs which uses a microprocessor to convert the electrical output of the Foxboro Control System into an equivalent Control Oil pressure signal to control MBFP speed and thereby FW flow to the SGs.
Review of the modification package confirmed it did not provide either routing details or installation expectations for the tubing run. Engineering concluded the tubing was field run under the direction of the feed pump control system vendor representative using supplemental personnel. The tubing installation did not meet IPEC workmanship standards for which historical and current procedural guidance states, "never connect two fittings in a straight line with each other, use bends or re-route the tubing." The failed tubing was stainless steel tubing with a nominal outside diameter of 0.500 inches with a nominal 0.035 inch wall thickness that normally operates with approximately 150 psi oil pressure at 120 to 130 degrees Fahrenheit. The tubing was straight field run from a bulkhead fitting without supports or stress relief bends.
Cause of Event
The direct cause of the decreasing SG levels was the trip of Main Boiler FW Pump (MBFP) 21 due to an autostop oil tubing/Swagelock fitting failure on the MBFP Autostop oil header. A straight section of autostop oil tubing connected to a bulkhead fitting in an oil reservoir for the 21 MBFP Autostop oil header fractured behind a back ferrule swage. The fracture caused a drop in oil pressure below the Autostop oil header trip set point. The root cause was improper tubing installation due to poor worker practices. An independent vendor equipment failure evaluation (EFE) determined the fracture was due to fatigue cracking from chronic cyclical stressing of the tubing. The fracture was caused by a combination of inappropriate tubing configuration and exposure to long term cyclical forces from vibration associated with rotating equipment. The straight tubing run with no bends to allow for expansion and contraction or to allow for motion under load resulted in vibration induced stress failure. The modification that installed the MBFP speed control system in 1986 did not provide routing or installation details for tubing runs although the fitting vendor manual contained examples of correct tubing routing and installation. The cause of the turbine runback failure was indeterminate but most likely an intermittent failure of the digital speed tachometer assembly.
Corrective Actions
The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:
- The fractured tubing for the 21 MBFP was replaced and reconfigured as was the tubing for the 22 MBFP to meet established installation requirements.
- Performed an independent equipment failure evaluation of the failed fitting.
- Implemented a troubleshooting plan on the turbine runback feature that confirmed the features were functional.
- Five year maintenance refresher training will be established for Swagelok fitting installation. Scheduled completion for establishing the maintenance refresher training is August 3, 2009.
- Supplemental worker training for Swagelok fitting installation will be developed.
Scheduled completion for developing the supplemental worker training is August 3, 2009.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS) including RT and AFWS actuation. This event meets the reporting criteria because a manual RT was initiated at 11:36 hours, on April 3, 2009, and the AFWS actuated as a result of the RT. The failure of the MBFP Autostop oil header did not result in the loss of any safety function. Therefore, there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v).
Past Similar Events
A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved a RT from a MBFP failure. Two LERs were identified; LER-2007 004 and LER-2008-003. LER-2007-004 reported a RT due to decreasing SG levels and receipt of speed control alarms for the 21 and 22 MBFPs and decreasing MBFP speed.
The cause of the RT was loss of MBFP flow due to the failure of the power supply for the MBFP common suction pressure transmitter due to failure of its capacitors from age degradation. The root cause was insufficient verification of plant programs to address capacitor degradation due to human error. The cause for LER-2007-004 was a program verification failure, whereas this LER was caused by poor worker installation practices. Therefore, corrective actions for this event would not have prevented the event reported in this LER. LER-2008-003 reported a RT due to decreasing SG levels and loss of main generator load due to a main turbine runback.
The main turbine runback was due to a failure of a main turbine steam inlet pressure bistable coincidence with MBFP RPM less than 3300 and turbine runback Arm/Defeat switch in the Arm position. The cause of the event was weak procedural guidance for positioning the Arm/Defeat switch and failure to follow a startup procedure. The cause of this event was procedural and personnel error and although it included a failed component, the failed component was not the identified cause. Therefore corrective actions for LER-2008-003 would not have prevented this event.
Safety Significance
This event had no effect on the health and safety of the public.
There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents. Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure. While stabilized, a gland steam regulator failed requiring shift of decay heat removal from the condensers to the atmospheric dump valves.
There were no significant potential safety consequences of this event under reasonable and credible alternative conditions. A RT and the reduction in SG level is a condition for which the plant is analyzed. This event was bounded by the analyzed event described in UFSAR Section 14.1.9, Loss of Normal Feedwater. A low water level in the SGs due to loss of normal FW initiates actuation of the AFWS.
The AFWS has adequate redundancy to provide the minimum required flow assuming a single failure. The analysis of a loss of normal FW shows that following a loss of normal FW, the AFWS is capable of removing the stored and residual heat plus reactor coolant pump waste heat thereby preventing either over pressurization of the RCS or loss of water from the reactor.
An automatic turbine load runback signal is generated in the event of a trip of one of the two MBFPs to automatically increase the speed of the operating MBFP and initiate an automatic main turbine runback. The automatic runback design feature reduces load to allow a new secondary side equilibrium state to be established. The turbine runback feature is not required for reactor protection. UFSAR Section 14.1.4 analysis for rod cluster control assembly (RCCA) drop states the Westinghouse Owners Group (WOG) dropped rod protection modification program evaluation bound possible operation without turbine runback and shows that the applicable licensing basis acceptance criteria is met. The automatic turbine runback functionality for RCCA drop has been administratively deleted. For this event, rod control was in automatic and all rods inserted upon initiation of a manual reactor trip. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.