05000296/LER-2004-002

LER-2004-002, Reactor Scram from Main Turbine Trip from Loss of All Speed Feedback

Browns Ferry Unit 3
Event date:	11-23-2004
Report date:	01-24-2005
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
2962004002R00 - NRC Website

I. PLANT CONDITION(S)

Prior to the turbine trip/reactor scram event, Unit 2 and Unit 3 were each in Mode 1 at 100 percent reactor power (approximately 3458 megawatts thermal). Unit 1 was shutdown and defueled and was unaffected by the event. Unit 2 also experienced transient turbine speed changes as a result of the lightning-induced grid disturbance, but otherwise it also was unaffected by this event.

II. DESCRIPTION OF EVENT

A. Event:

On Tuesday, November 23, 2004, while Unit 3 was in steady state operation at 100% power, a main turbine [TA] trip and subsequent reactor scram occurred at 1002 hours0.0116 days <br />0.278 hours <br />0.00166 weeks <br />3.81261e-4 months <br /> CST. All expected system responses occurred. Actuation of primary containment isolation system (PCIS) [JM] Groups 2, 3, 6, and 8 occurred due to the expected temporary lowering of reactor water level below the actuation setpoint. This logic isolates shutdown cooling [BO] (if in service), isolates the reactor water cleanup (RWCU) [CE] system, isolates the normal reactor building ventilation [VA], initiates the standby gas treatment (SGT) [BH] system, initiates the control room emergency ventilation (CREV) [VI] system, and retracts Traversing Incore Probes [IG] (if inserted). The normal heat rejection path (from the reactor to the main condenser via the steam lines with reactor water make­ up provided by the condensate/feedwater systems [SD/SJ]) remained in service. Reactor water level was recovered to the normal operating range by the normal reactor water level control system. Neither the high pressure coolant injection (HPCI) [BJ] nor reactor core isolation cooling (RCIC) [BN] systems were used during this event. Reactor water level did not drop to the auto­ initiation point for these systems, and they were not manually placed in service by the control room staff. No safety-relief valve (SRV) [SB] operation occurred during the trip transient, and post-trip review confirmed that peak reactor pressures remained below the nominal SRV lift setpoints.

A lightning strike occurred on the WA 500-kV system approximately 40 miles distant from Browns Ferry on the transmission line connecting the Browns Ferry switchyard with TVA's West Point, Mississippi substation. This strike resulted in a phase-to-ground fault on all three phases of the and Unit 3 main turbines. The rate of speed change seen on Unit 3 was slightly greater than the maximum rate anticipated by the turbine electro-hydraulic control (EHC) [JI/JJ] system logic, and therefore the turbine speed feedback signals, while valid, were designated as invalid by the logic.

With all turbine speed feedback signals designated as invalid, a main turbine trip on loss of speed feedback occurred in accordance with the system design. Since the unit was operating at a power level greater than the bypass point for the direct turbine trip-reactor scram signal, the reactor protection system (RPS) [JC] logic directly initiated a reactor scram.

Because this event involved the valid, automatic actuation of the RPS and the operation of containment isolation valves in more than one system, and because the scram was not part of a pre-planned sequence, this event is reportable in accordance with 10 CFR 50.73 (a) (2) (iv) (A).

B. Inoperable Structures, Components, or Systems that Contributed to the Event:

None C. Dates and Approximate Times of Major Occurrences:

November 23, 2004 1002 hours0.0116 days <br />0.278 hours <br />0.00166 weeks <br />3.81261e-4 months <br /> (To)�lightning strike on West Point 500-kV transmission line approximately 40 miles from Browns Ferry To + 33 msec �the resulting fault is isolated by breaker operation To + 132 msec rate of Unit 3 speed change exceeds setpoint and all speed channels are designated as invalid. Turbine trip initiated.

To + 432 msec�physical trip of Unit 3 turbine accomplished. The reactor scram was directly initiated by the turbine trip D. Other Systems or Secondary Functions Affected None E. Method of Discovery The turbine trip/reactor scram event was immediately apparent to the control room staff through numerous indications and alarms.

F. Operator Actions This event was an uncomplicated scram. All operator actions taken in response to the scram and in the recovery from the event were appropriate. These actions included the verification that the reactor had been successfully shut down, the expected system isolations and initiations had occurred, and accomplishing the subsequent restoration of these systems to normal alignments.

G. Safety System Responses All equipment operated in accordance with the plant design during this event with the exception of a single isolation valve on the scram discharge volume.

The RPS logic responded to the turbine trip condition per design to initiate the reactor scram. All control rods fully inserted into the core. A single scram discharge volume drain isolation valve (3-FCV-085-0037F) on the east header failed to close. The series valve, 3-FCV-085-0037E, automatically closed and successfully isolated the drain flow path.

The PCIS logic responded per design to the expected lowered reactor water level by actuating the following isolation groups:

• Group 2 - Residual Heat Removal shutdown cooling function isolation (not in service at the time of the event)

• Group 3 - RWCU system isolation

• Group 6 - primary and secondary containment isolation, including the isolation of the normal reactor building ventilation and the initiation of the SGT and CREV systems

• Group 8 - withdrawal and isolation of the Traversing Incore Probes (the probes were not inserted at the time of this event) Reactor water level was maintained by the condensate/feedwater systems and the normal water level control systems such that no automatic or manual operation of the HPCI or RCIC systems occurred during this event.

III. CAUSE OF THE EVENT

A. Immediate Cause

The immediate cause of this event was the designed response of the main turbine EHC logic to initiate a main turbine trip when a condition occurs where no valid turbine speed signals are available.

B. Root Cause

Unanticipated turbine speed changes occurred during a grid disturbance caused by a lightning strike. The rate of speed change exceeded system design parameters such that the individual speed feedback channels were designated as invalid by the system logic.

IV. ANALYSIS OF THE EVENT

This event was an uncomplicated plant scram with major plant systems responding in accordance with the plant design. The event as it occurred is addressed in detail by the plant Final Safety Analysis Report (FSAR), and the plant conditions assumed in the FSAR for analyzing this event are more severe than the actual conditions which were in existence at the time of this event. See Section V.

below for further details.

Upon reaching a condition where there were no speed feedback signals designated as valid, the EHC logic initiated a turbine trip by immediately closing the stop and control valves. The RPS logic is designed such that a main turbine trip with reactor power above approximately 30% reactor power will directly scram the reactor. These trip actions occurred in accordance with the plant design.

With one exception, equipment response following the reactor scram and turbine trip was also in accordance with the plant design. All control rods fully inserted. A single scram discharge volume drain isolation valve failed to close, however, the series isolation valve operated properly to isolate the drain flow path. Post-trip reactor pressure control was handled by operation of the turbine bypass valves. The operation of other systems post-scram (e.g., containment isolation, start-up of SGT and CREV, isolation of normal reactor building ventilation, RWCU isolation, TIP isolation, etc.) also occurred in accordance with the plant design. The main condenser continued to function as the heat sink following the scram. All operator actions in response to the event were appropriate.

The lightning strike occurred on the West Point transmission line approximately 40 miles distant from Browns Ferry. This particular strike had the unusual effect of causing a phase-to-ground fault simultaneously on all three phases of the line. In the immediate aftermath of the strike, before the breakers on either end of the line could respond, this fault created a large current drain and a significant voltage sag locally on the WA system. The combined current-voltage transient combined to reduce the power demand seen by the BFN generators and initially caused an acceleration of both operating BFN turbine-generators from a nominal speed of 1800 rpm. Opening of transmission system breakers 5204 and 5208 at BFN and two analogous breakers at the West Point substation then isolated the fault from the system. With the fault removed, and as the system voltage, current, and power demands returned to near pre-event levels, the BFN turbine-generators were slowed from the highest speeds attained through the nominal 1800 rpm to speeds below 1800 rpm. All of the above actions occurred in a very short length of time — on the order of 130 milliseconds (less than 8 waveform cycles at 60 Hz).

The absolute speeds which the turbine-generator sets attained during the transient were not remarkable, however, the observed rate of speed change was very fast. Additionally, the torsional response of the long turbo-generator main shafts affected the speed measurement. The BFN EHC logic contains an algorithm which compares the speed value reported by a speed channel to the average of all valid channels as obtained at the last previous sample. The purpose of this algorithm is to identify a failed speed channel as evidenced by the channel indicating a significant difference from the average of all the channels.

The setpoint for this difference value was 15 rpm in a single scan cycle of 40 milliseconds. An acceleration rate beyond this magnitude was deemed to be too fast to be real by empirical, industry­ accepted data, and an instrument channel reporting such a speed change would therefore be suspect.

However, in the subject event, the measured Unit 3 turbine-generator speed actually increased by greater than 15 rpm within a single 40 millisecond scan cycle. As each speed channel was scanned and reported the actual measured speed to the system computer, the algorithm described above designated the channel as invalid since the rpm difference relative to the previous value was too great. Each of the 8 speed channels was sequentially designated invalid in this manner, and when no valid channels remained, other system logic initiated a turbine trip due to the loss of all speed feedback.

The BFN Unit 2 EHC logic is configured identically to that of Unit 3, however, during the transient the measured Unit 2 speed changes did not exceed 15 rpm in any single 40 msec scan cycle. Factors which may have contributed to the different speed responses between the two units include a different VAR loading prior to the event, how the instrumentation scan cycles on Unit 2 correlated in real time to the actual speed changes caused by the lightning strike and fault, and unique torsional response characteristics for each of the two units.

V. ASSESSMENT OF SAFETY CONSEQUENCES

FSAR sections 14.5.2.4 and 14.5.2.5 specifically address the main turbine trip event. Turbine bypass valves are assumed to function in the discussion under section 14.5.2.4. Section 14.5.2.5, however, assumes that the main turbine bypass valves do not function and therefore is the more severe event.

This analysis assumes the most limiting initial conditions of: end of cycle fuel exposure conditions, a core power of 100% of rated, a core flow of 105% of rated, and normal feedwater temperature. The analysis shows that no safety limits are exceeded for such a transient scenario. The actual plant conditions for this event were less limiting than those described in the FSAR section 14.5.2.5 analysis, and the subject event is fully bounded by this analysis. The health and safety of the public were not affected by the subject scram event.

VI. CORRECTIVE ACTIONS

A. Immediate Corrective Actions

The +/- 15 rpm difference setpoint was changed to +20/-36 rpm.

B. Corrective Actions to Prevent Recurrence) 1. Analyze/evaluate speed indications and logic response to determine if trip logic changes are desirable.

2. Evaluate the EHC logic to identify if any other trips exist that are not essential for equipment protection 3. Implement any logic changes identified in Actions 1 and 2 on BFN Unit 2 and Unit 3. Any such logic changes will also be implemented on BFN Unit 1 prior to its restart.

A. Failed Components

Scram Discharge Volume drain isolation valve 3-FCV-085-0037F (Crane Company) B. Previous LERs on Similar Events None

C. Additional Information

Browns Ferry corrective action document PER 72670 D.�Safety System Functional Failure Consideration:

This event does not involve a safety system functional failure which would be reported in accordance with NEI 99-02. The scram was caused by the response of non-safety related equipment to an off-site event. All safety-related equipment performed in accordance with design in response to the event.

E. Loss of Normal Heat Removal Consideration:

The main condenser was retained as the heat sink during this event, and the condensate/feedwater systems continued to provide reactor vessel inventory make-up. Neither HPCI nor RCIC operated during this event. This event does not constitute a scram with a loss of normal heat removal which would be reported in accordance with NEI 99-02.

VIII. COMMITMENTS

None (1) TVA does not consider this corrective action a regulatory commitment. The completion of this action will be tracked in TVA's Corrective Action Program.