05000296/LER-2006-002
| Browns Ferry Unit 3 | |
| Event date: | 08-19-2006 |
|---|---|
| Report date: | 10-17-2006 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 2962006002R00 - NRC Website | |
I. PLANT CONDITION(S)
Prior to the event, Units 2 and 3 were in operating in Mode 1 at 100 percent thermal power (approximately 3458 megawatts thermal). Unit 1 was shutdown and defueled. Units 1 and 2 were unaffected by the event.
II. DESCRIPTION OF EVENT
A. Event:
On August 19, 2006, at 1105 hours0.0128 days <br />0.307 hours <br />0.00183 weeks <br />4.204525e-4 months <br /> central daylight time (CDT), Unit 3 was manually scrammed following a loss of both the 3A and 3B Reactor Recirculation pumps [AD]. Just prior to the event, the Unit 3 Unit Operator (UO) received alarms indicating low reactor water level, reactor feedwater level control system failure [SJ], and failure of the input/output modules for both the 3A and 3B Reactor Recirculation pumps. The UO also reported that main generator load was approximately 730 megawatts electrical (approximately 64 percent of full power output) and the lowering. Based on these indications, the UO scrammed the reactor in accordance with Abnormal Operating Instruction, 3-A0I-68-1A, "Recirc Pump Trip/Core Flow Decrease OPRMs Operable," and entered Abnormal Operating Instruction, 3-A0I-100-1, "Reactor Scram." At approximately 1106 hours0.0128 days <br />0.307 hours <br />0.00183 weeks <br />4.20833e-4 months <br /> CDT, 3-E0I-1, "Emergency Operating Reactor Pressure Vessel Control," was entered on low reactor water level.
During the event, all automatic functions resulting from the scram occurred as expected. All control rods inserted. The Primary Containment Isolation System (PCIS) [JE] isolations Group 2 (Residual Heat Removal (RHR) System [BO] Shutdown Cooling), Group 3 Reactor Water Cleanup (RWCU) [CE], System Group 6 (Ventilation), and Group 8 Traversing Incore Probe (TIP) [IG] were received along with the auto start of the Control Room Emergency Ventilation (CREV) [VI] System and the three Standby Gas Treatment (SGT) [BH] System trains.
At approximately 1107 hours0.0128 days <br />0.308 hours <br />0.00183 weeks <br />4.212135e-4 months <br /> CDT the reactor scram was reset. The PCIS actuations were reset; SGT and CREV systems were secured by approximately 1115 hours0.0129 days <br />0.31 hours <br />0.00184 weeks <br />4.242575e-4 months <br /> CDT. Emergency Operating Instruction, 3-E0I-1, was exited approximately 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br /> CDT. Reactor water level and heat rejection was being maintained by the feedwater and condensate [SD] system. No main steam relief valves [SB] opened following the scram. Reactor pressure was controlled by the main steam bypass valves [JI].
This report is submitted in accordance with 10 CFR 50.73(a)(2)(iv)(A), as an event that resulted in a manual or automatic actuation of the systems listed in paragraph 10 CFR 50.73(a)(2)(iv)(B) (i.e., Reactor Protection System including reactor scram or trip, and general containment isolation signals affecting containment isolation valves in more than one system).
B. Inoperable Structures, Components, or Systems that Contributed to the Event:
None.
C. Dates and Approximate Times of Major Occurrences:
August 19, 2006 1105 hours0.0128 days <br />0.307 hours <br />0.00183 weeks <br />4.204525e-4 months <br /> CDT Unit 3 operators received alarms indicating a shutdown of both the 3A and 3B Reactor Recirculation pumps. Operators manually scrammed the Unit 3 reactor.
August 19, 2006 1107 hours0.0128 days <br />0.308 hours <br />0.00183 weeks <br />4.212135e-4 months <br /> CDT� Operations reset the reactor scram.
August 19, 2006 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br /> CDT� WA made a four hour non-emergency report per 10 CFR 50.72(b)(2)(iv)(B) and an eight hour non-emergency report per 10 CFR 50(b)(3)(iv)(A).
D. Other Systems or Secondary Functions Affected
None.
E. Method of Discovery
The shutdown of 3A and 3B Reactor Recirculation Pumps was immediately apparent to the operating crew through numerous indications and alarms in the Unit 3 Main Control Room.
The manual reactor scram was initiated by the Unit 3 RO.
F. Operator Actions
Operations personnel responded to the event according to applicable plant procedures. They verified through multiple indications that both recirculation pumps had shutdown and, with the concurrence of the Unit Supervisor, carried out the actions required by 3-A0I-68-1A and 3-A0I-100-1.
G. Safety System Responses
All control rods inserted. The PCIS isolations Group 2 (RHR System Shutdown Cooling), Group 3 Reactor RWCU System, Group 6 (Ventilation), and Group 8 TIP isolation were received along with the auto start of the CREV System and the three SGT System trains.
Emergency Core Cooling System actuation was not required.
Ill. CAUSE OF THE EVENT
A. Immediate Cause
The immediate cause of the manual scram was the loss of both the 3A and 3B Reactor Recirculation pumps. The manual scram was required by the conditions presented to the Unit 3 operators following the loss of recirculation flow as specified in the A01. The initial investigation into the trip found the Variable Frequency Drive (VFD) [AD] microprocessors non-responsive. The control power was cycled off and on, the processors were reset, and the VFDs were restarted.
B. Root Cause
The root cause of the event was the VFD controls malfunctioned due to excessive traffic on the connected plant Integrated Control System (ICS) [JA] network. The investigation into this event determined that the Unit 3 Condensate Demineralizer [SF] primary processor failed simultaneously with the Unit 3 VFD microprocessors. The Condensate Demineralizer primary processor is a dual redundant Allen Bradley PLC5 control, system which interfaces with the Unit 3 ICS through a network connection to the VFD processor.
Testing by site personnel following the event could not conclusively determine if the failure of the Allen Bradley controller caused the VFD failure or was a symptom of a common failure; however, based on information later received from Allen Bradley, the PLC controller failure was a likely symptom.
Testing of the VFD control system has found the system is susceptible to failures induced by excessive network traffic. The threshold levels for failure as determined by testing are within the capabilities of a single device on a 10 megabit network connection. The most probable root cause for the event was the excessive network traffic.
C. Contributing Factors
None.
IV. ANALYSIS OF THE EVENT
The Reactor Recirculation System provides forced circulation of water through the reactor core, thus achieving even flow distribution of water through all fuel channels. By controlling the rate of forced circulation through the core, even flow distribution is achieved in all fuel channels and a higher specific power level can be attained. A microprocessor controlled VFD, supplies power to the reactor recirculation pumps at any frequency between approximately 11.5 Hz to 57.5 Hz, thus controlling the Reactor Recirculation System pump speed.
During the initial investigation into the loss of recirculation flow, the VFD microprocessors were found to be non-responsive. When the VFD digital control system microprocessors ceased to provide data to the VFD power cells, they stopped providing power to the reactor Recirculation Pump motors as expected and designed.
V. ASSESSMENT OF SAFETY CONSEQUENCES
The safety consequences of this event were not significant. The trip of both Reactor Recirculation pumps is an analyzed event, and operation without the reactor recirculation pumps is a condition for which the plant is also analyzed. Manual reactor scram from 100 percent thermal power is an analyzed transient for which the plant is designed. Because recirculation flow had ceased reactor power was less than full power, the scram was less severe than a manual scram at full reactor power. The plant response to the manual scram was as expected.
All safety systems operated as required. PCIS groups 2, 3, 4, 6, and 8 isolations were as expected. Operator actions were appropriate and consistent with plant procedures. Reactor water level lowered to Level 3, but remained above Level 2; therefore, High Pressure Coolant Injection [BJ] and Reactor Core Isolation Injection [BN] Systems did not actuate. The main steam relief valves did not open, reactor pressure was maintained by the main steam turbine bypass valves.
Reactor water level was recovered and maintained by the reactor feed pumps. Therefore, WA concludes that the health and safety of the public was not affected by this event.
VI. CORRECTIVE ACTIONS
A. Immediate Corrective Actions
Operations personnel placed the reactor in a stable condition in accordance with plant procedures and commenced reactor cooldown at less than 90 degrees F per hour. The VFD microprocessors were reset. To ensure excessive plant ICS network traffic will not result in the Unit 3 VFD processor malfunctions, WA disconnected the microprocessors from the plant ICS network prior to restart. The Unit 2 VFD microprocessors have also been disconnected from the plant ICS network.
B. Corrective Actions to Prevent Recurrence (1) 1. TVA is developing a network firewall device that can be used to limit the connections and traffic to any potentially susceptible devices on the plant ICS network.
2. TVA will install a network firewall device on each Unit's VFD controller and condensate demineralizer controller.
VII. ADDITIONAL INFORMATION
A. Failed Components
Allen Bradley Processor PLC5/40, Catalog number 1785-L40E/C B. Previous LERs on Similar Events None.
C. Additional Information
Corrective action document PER 109107.
D. Safety System Functional Failure Consideration:
No safety functions were compromised as a result of this event. Therefore, this event is not considered a safety system functional failure in accordance with NEI 99-02 in that functional capability of the overall system was not justified.
E. Loss of Normal Heat Removal Consideration:
The condenser remained available, providing a normal heat removal path following the reactor scram. Accordingly, this event did not result in a scram with a loss of normal heat removal as defined in NEI 99-02.
VIII. COMMITMENTS
None.
(1) TVA does not consider these corrective actions as regulatory requirements. The completion of these actions will be tracked in TVA's Corrective Action Program.