05000286/LER-2009-007

LER-2009-007, Automatic Reactor Trip Due to a Turbine Trip As a Result of Turbine Autostop Oil Actuation Caused by a Failed Autostop Oil Fitting

Indian Point 3
Event date:	8-27-2009
Report date:	21-10-2009
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function
2862009007R00 - NRC Website

Note: The Energy Industry Identification System Codes are identified within the brackets {}.

DESCRIPTION OF EVENT

On August 27, 2009, at 19:42 hours, while at approximately 100% steady state reactor power, Control Room operators received a Turbine Trip (TT) {JJ} First Out Annunciator for a Turbine Control Oil Autostop Trip and Reactor Trip (RT) {JC}. All control rods {AB} fully inserted and all required safety systems functioned properly. No Emergency Diesel Generator (EDG) started as offsite power remained available. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}.

There was no radiation release. The Auxiliary Feedwater (AFW) System {BA} automatically started as expected due to Steam Generator low level from shrink effect.

The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP3-2009-03592. A post transient evaluation was initiated and completed on August 28, 2009.

An investigation was initiated and after removal of the turbine governor front pedestal enclosure a 316 Stainless Steel Schedule 160 Swagelok one-half inch National Pipe Thread (NPT) to three-quarter inch tubing adaptor fitting {PSF} was discovered failed on the line connecting the Turbine Autostop oil to the Turbine solenoid trip devise (20/ASB) {SOL}. The failed tubing adaptor affected the Autostop oil system {JJ}. To protect the Main Turbine from an over speed condition and to eliminate the positive reactivity inserted by the reactor coolant system (RCS) cooldown following a RT, the plant design incorporates turbine trip devices that are connected hydraulically to the overspeed trip valve through the overspeed trip relay. The turbine trip devices include, 1) Low bearing oil pressure trip, 2) electronically actuated solenoid trips, 3) Thrust bearing trip, 4) Low vacuum trip. The four devices in the protective trip assembly operate a fulcrum pivot plate that opens the Autostop oil trip valve when a protection setpoint is exceeded and connects the overspeed trip valve chamber to the lube oil system drain. The remaining solenoid valve (20/ASB) directly drains Autostop oil from the overspeed trip mechanism. A loss of Autostop oil pressure causes the following; 1) governing emergency trip valves open dumping the control valve oil pressure, 2) springs reposition devices for all the turbine stop and control valves which dump the high pressure (HP) oil used to open the valves, 3) Oil operated air pilot valve repositions shutting off the air and venting the non-return check valves and turbine stop bypass valves. Two solenoids are provided in the Turbine Protection system; 1) 20/AST which raises the protective trip dump pivot plate and dumps the HP Autostop oil to the lube oil sump, 2) 20/ASB which will drain the HP Autostop oil from the overspeed trip mechanism regardless of the status of the trip test levers.

The turbine protection system includes four spring loaded turbine stop valves, one for each of four main steam lines that are held open hydraulically by pressurized oil.

Opening redundant solenoid dump valves and hydraulic dump valves drain the Autostop oil removing oil pressure allowing the turbine stop valves to close assisted by spring action. Solenoids 20/AST and 20/ASB are energized to dump the Autostop oil when a trip is required. The Autostop oil system serves as a hydraulic link between the turbine protective devices and the control devices that regulate the turbine steam admission valves.

The failed fitting is a Swagelok (Crawford Fitting Co/Swagelok TM) {C685} pipe to tube adaptor {PSF} (3/4 inch tube fitting to 1/2 inch male NPT connector), part number SS­ 1210-1-8.

Corrective Actions

The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event.

• The failed fitting was replaced with the same as-found configuration. An assessment of operating with this configuration to the next refueling outage determined it would be acceptable.

• The failed fitting was submitted to an independent vendor for failure analysis. The equipment failure evaluation (EFE) was completed and a preliminary report was provided by the vendor.

• The Autostop oil lines were inspected, and vibration monitoring performed on turbine bearing No. 1 and the governor pedestal.

• A limited visual inspection was performed on Unit 3 during the forced shutdown.

• An Engineering Change will be developed to redesign the turbine pedestal piping wall penetration for the Autostop oil turbine protection solenoid valve. Scheduled completion is May 30, 2010.

• An inspection will be performed at Unit 2 and 3 to confirm that other threaded fitting installations are not impacted by high compressive loads by bottomed out male threads on systems where single fitting failure would lead to a unit transient.

Scheduled completion is May 30, 2010.

• The final EFE will be reviewed for any impacts to the RCA and necessary updates incorporated. Scheduled review of the EFE and recommendations are scheduled to be complete November 30, 2009.

• The lessons learned from this event will be incorporated into the Maintenance base training. Scheduled completion is February 25, 2010.

Event Analysis

The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS) including RT, and AFWS actuation. This event meets the reporting criteria because an automatic RT was initiated at 19:422 hours, on August 27, 2009, and the AFWS actuated as a result of the RT. The RT did not result in the failure of any primary system to function properly. Therefore, there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v). On August 27, 2009, at 20:40 hours, a 4-hour non-emergency notification was made to the NRC for an actuation of the reactor protection system while critical and included an 8-hour notification under 10CFR50.72(b)(3)(iv)(A) for a valid actuation of the AFW System (Event Log # 45306).

Past Similar Events

A review was performed of Unit 3 Licensee Event Reports (LERs) over the past three years for Unit 3 events that involved a RT from a failure of the main turbine Autostop oil system. No LERs were identified. LERs at Unit 2 were also reviewed and LER-2009­ 002 reported an autostop oil tubing/fitting failure on the Main Boiler Feedwater Pump (MBFP) Autostop oil header due to improper tubing installation caused by poor worker practices. The tubing installation was straight with no bends to allow for expansion and contraction or to allow for motion under load which resulted in a vibration induced stress failure. The tubing on the redundant Unit 2 MBFP was inspected and a similar inappropriately routed tubing was discovered and replaced using proper tubing configuration. Unit 3 MBFP tubing was also inspected as a result of this event and found to be in an acceptable configuration. The fitting condition reported in this LER would not be visually detectable.

Safety Significance

This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because there were no other transients or accidents at the time of the RT. Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure.

There were no significant potential safety consequences of this event under reasonable and credible alternative conditions. A RT and the reduction in SG level is a condition for which the plant is analyzed. This event was bounded by the analyzed event described in FSAR Section 14.1.8, Loss of External Electrical Load. The response of the plant is evaluated for a complete loss of steam load from full power without a direct RT and includes the acceptability of a loss of steam load without direct RT on turbine trip below 35 percent power. The analysis shows that the plant design is such that there would be no challenge to the integrity of the reactor coolant system or main steam system and no core safety limit would be violated. A low SG water level initiates actuation of the AFWS whose design has adequate capability to provide the minimum required flow assuming a single failure.

For this event, rod controls were in Auto and all rods inserted upon initiation of the automatic RT. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation.

Pressurizer level remained on scale. Following the RT, the plant was stabilized in hot standby.