05000296/LER-2009-001
| Browns Ferry Nuclear Plant Unit 3 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 2962009001R00 - NRC Website | |
I. PLANT CONDITION(S)
Prior to the event, Units 1, 2, and 3 were operating in Mode 1 at 100 percent thermal power (approximately 3458 megawatts thermal). Units 1 and 2 were unaffected by the event.
II. DESCRIPTION OF EVENT
A. Event:
Prior to the manual scram on August 24, 2009, Unit 3 was at 100% power within normal operating parameters. All nine (A-J) condensate demineralizers [SF] were in service. All programmable logic controller controlled valves, including the A (inlet), E (effluent), V (vent), U (drain) and Us (slow drain) valves, were mechanically locked in the open position (pinned) for H and J condensate demineralizer vessels due to earlier maintenance activities. The A, E, V and U valves for the remaining seven condensate demineralizer vessels had been un-pinned. The remote communication adapter and the remote chassis associated with the H condensate demineralizer vessel were replaced due to re-occurring failures of the 120 VAC digital output card. No other abnormal conditions existed for Unit 3 related to power operation on this day. Following the maintenance on August 24, 2009, day shift, A through G condensate demineralizer vessels were unpinned (i.e., returned to normal controls) and H and J condensate demineralizer vessels remained pinned in their desired positions.
At approximately six hours after performing maintenance on Programmable Logic Controller Remote Chassis 10 associated with 3H condensate demineralizer, all 10 of the Unit 3 remote communication chassis failed. This condition resulted in de-energizing all of the 120 VAC solenoid valves on each condensate demineralizer vessel. The condensate demineralizer vessel effluent valves (E valves) closed on all condensate demineralizer vessels except for condensate demineralizer vessels 3C, 3F, 3H and 3J. The E valves for condensate demineralizer vessels 3H and 3J had been pinned. The lock-up solenoids for the E valves associated with condensate demineralizers 3C and 3F prevented the closure of their respective E valves when the lock-up solenoid valves engaged. The condensate demineralizer system differential pressure logic actuated to provide an open signal to the bypass valve, but the condensate demineralizer bypass valve did not open due to a failed coil on the open air solenoid valve.
Condensate booster pump 3A tripped on low suction pressure followed by a trip of condensate booster pump 3B, as designed. The Reactor Feedwater Pump Turbine (RFPT) suction header experienced low suction pressure, but feedwater pump 3A did not trip as expected. Feedwater pump 3B tripped as expected. A control room operator inserted a manual reactor scram due to lowering reactor water level. Reactor vessel water level decreased to -47 inches and was recovered by High Pressure Coolant Injection (HPCI) system [BJ] and Reactor Core Isolation Cooling (RCIC) system [BN] initiation. TVA's initial investigation found the communication adapter for Programmable Logic Controller Remote Chassis 10 (which is associated with condensate demineralizer vessel 3H) with status lights indicating a communications failure had occurred, which caused an apparent loss of communication with the remote chassis associated with the other condensate demineralizer vessels.
During the event, all automatic safety system functions resulting from the scram occurred as expected. All control rods inserted. As a result of low reactor vessel water level, the following Primary Containment Isolation System (PCIS) isolations [JM] were received: Group 2 Residual Heat Removal (RHR) System [BO] Shutdown Cooling, Group 3 Reactor Water Cleanup (RWCU) System [CE], Group 6 Ventilation [VA], and Group 8 Traversing Incore Probe (TIP) [IG]; along with the automatic start of the Control Room Emergency Ventilation (CREV) [VI] System and the three Standby Gas Treatment (SGT) [BH] System trains. In addition, HPCI and RCIC systems automatically initiated as a result of the decrease in reactor vessel water level.
WA is submitting this report in accordance with 10 CFR 50.73(a)(2)(iv)(A). An event that resulted in a manual or automatic actuation of the systems listed in paragraph 10 CFR 50.73(a)(2)(iv)(B) (i.e., reactor protection system including reactor scram or trip).
B. Inoperable Structures, Components, or Systems that Contributed to the Event:
None.
C. Dates and Approximate Times of Major Occurrences:
Condensate Demineralizer Remote Communication Chassis Failure Condensate Booster Pump 3A trip on low suction pressure Condensate Booster Pump 3B trip on low suction pressure Feedwater Pump 3B trip on low suction pressure WA made a four hour non-emergency report per 10 CFR 50.72(b)(2)(iv)(B) and an eight hour non-emergency report per 10 CFR 50.72(b)(3)(iv)(A).
D. Other Systems or Secondary Functions Affected
None.
E. Method of Discovery
Operations received Condensate Booster Pumps 3A and 3B trip alarms along with reactor water level lowering.
F. Operator Actions
Manual scram initiated due to loweringl'eactor vessel water level.
G. Safety System Responses
During the event, all automatic functions resulting from the scram occurred as expected except for the feedwater pump 3A failure to trip. All control rods inserted. As a result of low reactor vessel water level, the following PCIS isolations [JM] were received: Group 2 RHR System [BO] Shutdown Cooling, Group 3 RWCU [CE], Group 6 Ventilation [VA], and Group 8 TIP [IG]; along with the automatic start of the CREV [VI] System and the three SGT [BH] System trains. Reactor vessel water level lowered to -47 inches. Reactor vessel water level was recovered by HPCI and RCIC system automatic initiation and operation and subsequently, maintained by the feedwater system.
All control rods inserted and reactor pressure was controlled by the main turbine bypass valves, and no Main Steam Relief Valves (MSRVs) were opened as a result of the transient.
All plant systems responded to the event as expected except for the condensate demineralizer bypass valve failure to open, feedwater pump 3A failure to trip on an apparent low suction pressure, and reactor core isolation cooling (RCIC) flow fluctuations.
III. CAUSE OF THE EVENT
A. Immediate Cause
The immediate cause of the event was the failure of all ten of the Unit 3 condensate demineralizer remote communication chassis.
B. Root Cause
The root cause was determined to be the less than adequate functional testing of the condensate demineralizer system valve lock-up devices.
C. Contributing Factors
None.
IV. ANALYSIS OF THE EVENT
The condensate demineralizer filter system is designed to remove impurities from the condensate system to maintain high quality water to supply the reactor. The condensate demineralizer system is controlled by a dual Allen Bradley 5 programmable logic controller (PLC) system, with 10 remote communication chassis, one to control each of the nine condensate demineralizer vessels and one system control chassis. The dual PLC arrangement allows a fully redundant control system for the condensate demineralizer with two communication loops. Chassis-to-chassis communications are on one communication loop. The second communication loop provides communication access for the Human Machine Interface (HMI) stations. The condensate dernineralizer control system provides automatic control for the Vessel Backwashing and Precoat sequences to maintain optimum filter/resin performance inside each condensate demineralizer vessel.
There are two subcomponents of the lockup system, the lockup solenoid A and lockout solenoid B.
Solenoid A is a normally energized solenoid that will de-energize on loss of communication to PLC remote I/O chassis or loss of power. De-energizing solenoid A will remove the control pilot air from the snap acting relay pilot by blocking system air and venting the pilot air, allowing the snap relay to actuate. Lockout solenoid B is a normally energized solenoid that will de-energize on loss of communication to its PLC remote I/O chassis or on a loss of system power. De-energizing solenoid B will remove the control air from the valve positioner by blocking control air from the flow modifier and venting control air from the positioner.
The condensate flow path through the demineralizers is the only path with sufficient capacity to provide an adequate source of feedwater to the reactor vessel at 100 percent power. The condensate demineralizer bypass valve capacity of 30 percent may have been adequate to supplement the four condensate demineralizer vessels that did not isolate during this event. However, the condensate demineralizer bypass valve failed to open due to a failed coil on the open air solenoid valve. Thus, there was no other equipment which could have provided sufficient feedwater during this event.
All of the Unit 3 remote communication chassis failed, which resulted in de-energizing all the 120 VAC solenoid valves on each condensate demineralizer vessel. The condensate demineralizer vessel effluent valves (E valves) closed on all condensate demineralizer vessels except for condensate demineralizer vessels C, F, H and J. The E valves for condensate demineralizer vessels H and J had been pinned. The lockup solenoids for the E valves associated with condensate demineralizer vessels C and F prevented the closure of their respective E valves when the lock-up solenoid valves engaged.
Condensate booster pump 3A tripped on low suction pressure followed by condensate booster pump 3B. The 3A feed pump did not trip on low suction pressure as would be expected. The feed pump suction header pressure (as indicated on the integrated computer system) dropped to less than the 150 psig trip setpoint but the 3A feed pump did not trip. The 3B feed pump tripped. A control room operator inserted a manual reactor scram. Reactor water level decreased to -47 inches and was recovered by HPCI and RCIC initiation.
The 3A feed pump is designed to trip after a 20-second time delay, the 3B feed pump after a 40- second time delay and the 3C feed pump after a 60-second time delay. Each feed pump has its own low suction pressure switch. TVA verified proper calibration of the low suction trip pressure switch for the 3A feed pump. High pressure steam was isolated to the 3A feed pump prior to and during this event. As a result, the 3A feed pump speed actually decreased during the analyzed event, while the 3B and 3C feed pump speeds increased. Based on the suction header design, it appears that this reduction in speed (and thus flow) on the 3A feed pump resulted in the 3A feed pump having a slightly higher suction pressure than the low suction pressure trip set-point. A work order was performed to confirm pressure switch instrument calibration.
The RCIC system flow oscillations did not impact the ability of RCIC to provide injection flow to the vessel for the short duration that it was required. The cause of these flow oscillations is still being investigated. The RCIC system governor was replaced during a subsequent outage.
ECCS equipment response following the reactor scram was in accordance with plant design for loss of feedwater. The short term lowering of the reactor vessel water level was recovered by automatic HPCI and RCIC initiation and operation. Following the initial transient, reactor vessel water level was controlled by the feedwater system. The operation of other systems post scram (e.g., containment isolation, startup of the SGT and CREV systems, isolation of normal reactor building ventilation, Reactor Water Cleanup (RWCU) isolation operated as expected. The main condenser continued to function as the heat sink following the reactor scram.
V. ASSESSMENT OF SAFETY CONSEQUENCES
The safety consequences of this event were not significant. This transient is bounded by the analysis present in the UFSAR. When the reactor vessel water level reached the Level 2 setpoint, RCIC and HPCI initiated, returning reactor vessel water level to normal level. In addition, the feedwater system was used to maintain reactor vessel water level and the main condenser continued to serve as the heat sink.
PCIS groups 2, 3, 6, and 8 isolations were as expected. No main steam relief valves actuated. The turbine bypass valves [JI] maintained reactor pressure. The main condenser remained available for heat rejection. Reactor water level was recovered by RCIC and HPCI and maintained by reactor feedwater [SJ] and condensate [SG] systems.
All plant systems responded to the event as expected except for the condensate demineralizer bypass valve failure to open, feedwater pump 3A failure to trip on an apparent low suction pressure, and reactor core isolation cooling (RCIC) flow fluctuations. All personnel actions were according to established procedural guidance. TVA concludes that the health and safety of the public was not impacted by this event.
VI. CORRECTIVE ACTIONS
A. Immediate Corrective Actions
Immediate corrective actions included pinning in place the A, E, U, Us and V valves associated with all nine Unit 3 Condensate Demineralizer vessels using 3-0I-2A, Condensate Demineralizer System, Revision 43. The OPEN solenoid on 3 -FCV- 2-130 (demineralizer bypass valve) was replaced and the bypass valve was made functional. The A, E, U, Us and V valves associated with all 10 Condensate Demineralizers for Units 1 and 2 were also pinned in place.
B. Corrective Actions to Prevent Recurrence - The corrective actions are being managed by BFNs Corrective Action Program.
The corrective actions to prevent recurrence include developing a more robust testing methodology and frequency (preventative maintenance work orders) for ensuring the condensate demineralizers effluent lockup devices work properly and ensure the work orders are completed on all three units.
VII. ADDITIONAL INFORMATION
A. Failed Components
The failed component was the communication adapter for Condensate Demineralizer Programmable Logic Controller Remote Chassis 10 (which is associated with condensate demineralizer vessel 3H). It was found with status lights indicating a communications failure had occurred, which caused an apparent loss of communication with the remote chassis associated with the other condensate demineralizer vessels.
B. Previous LERs on Similar Events None.
C. Additional Information
Corrective action document PER 200203.
D. Safety System Functional Failure Consideration:
This event is not a safety system functional failure in accordance with NEI 99-02.
E. Scram with Complications Consideration:
This event was not a complicated scram according to NEI 99-02.
VIII. COMMITMENTS
None.