05000296/LER-2013-003

LER-2013-003, Automatic Reactor Shutdown Due to an Actuation of the Reactor Protection System From a Turbine Trip

Browns Ferry Nuclear Plant, Unit 3
Event date:	02-25-2013
Report date:	12-18-2013
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(B), System Actuation
2962013003R01 - NRC Website

I. Plant Operating Condition Before the Event At the time of the event, Browns Ferry Nuclear Plant (BFN), Unit 3, was in Mode 1 at approximately 92 percent power.

II. Description of Events

A. Event:

On February 25, 2013, at approximately 1313 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />4.995965e-4 months <br /> Central Standard Time (CST), the BFN, Unit 3, reactor automatically scrammed due to an actuation of the Reactor Protection System (RPS) [JC] from a turbine trip. The turbine tripped on low condenser vacuum due to a reactor feedwater [SJ] piping separation. The Main Steam Isolation Valves (MSIVs) [ISV] [SB] were manually closed. There was one Safety Relief Valve (SRV) that was manually operated to maintain reactor pressure due to the unavailability of the Main Turbine Bypass Valves [JI] upon loss of condenser vacuum. All systems responded as expected to the turbine trip. No Emergency Core Cooling System (ECCS) [BJ][BO][BM] or Reactor Core Isolation Cooling (RCIC) system [BN] reactor water level initiation set points were reached.

Reactor water level was controlled with the RCIC system and reactor pressure was controlled with the High Pressure Coolant Injection (HPCI) system. All control rods fully inserted and electrical offsite power was in a normal shutdown configuration and Residual Heat Removal was aligned for suppression pool cooling.

Also, Primary Containment Isolation System (PCIS) Groups 2, 3, 6, and 8 isolations were received due to low reactor water level. The PCIS consists of isolation valves that will automatically close as necessary to protect against the release of fission products, as well as, to conserve reactor coolant. Upon receipt of these isolations, the required components actuated, with the exception of one Group 6 valve, Drywell Continuous Air Monitor (CAM) Inboard Return Isolation Valve. The Drywell CAM Inboard Return Isolation Valve did not have indication following the isolation and was not able to be verified locally.

Due to the Drywell CAM Inboard Return Isolation Valve not actuating, BFN, Unit 3, Technical Specification (TS) Limiting Condition for Operation (LCO) 3.6.1.3 was entered.

The BFN, Unit 3, TS LCO 3.6.1.3 requires that each Primary Containment Isolation Valve (PCIV) be Operable in reactor Modes 1, 2, and 3, and when the associated instrumentation is required to be Operable per LCO 3.3.6.1, "Primary Containment Isolation Instrumentation." On February 25, 2013, at approximately 1313 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />4.995965e-4 months <br /> CST, TS 3.6.1.3 Condition A was entered due to one or more penetration flow paths with one PCIV inoperable. The TS 3.6.1.3 Required Action A.1 requires the affected penetration flow path to be isolated by use of at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured within four hours except for the main steam line which is required within eight hours. The TS 3.6.1.3 Required Action A.2 requires verification, once per 31 days, that the affected penetration flow path is isolated. Indication was subsequently restored following restoration of containment isolation signals, and the Drywell CAM Inboard Return Isolation Valve was manually isolated on February 25, 2013, at approximately 1422 hours0.0165 days <br />0.395 hours <br />0.00235 weeks <br />5.41071e-4 months <br /> CST with positive indication of isolation. On February 25, 2013, at approximately 1514 hours0.0175 days <br />0.421 hours <br />0.0025 weeks <br />5.76077e-4 months <br /> CST, the isolation valves were deactivated satisfying TS LCO 3.6.1.3 Required Actions.

On February 25, 2013, at approximately 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br /> CST, suppression pool water level exceeded -1.0 inches. Suppression pool water level could not be maintained within normal bands due to running HPCI system for pressure control and suppression pool water level was not able to be pumped down due to the reactor feedwater piping separation.

The BFN, Unit 3, TS LCO 3.6.2.2 requires that suppression pool water level shall be greater than or equal to -6.25 inches with and -7.25 inches without differential pressure control and less than or equal to -1.0 inches in reactor Modes 1, 2, and 3. On February 25, 2013, at approximately 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br /> CST, TS 3.6.2.2 Condition A was entered due to suppression pool water level not within limits. The TS 3.6.2.2 Required Action A.1 requires suppression pool water level to be restored within limits within two hours. On February 25, 2013, at approximately 1615 hours0.0187 days <br />0.449 hours <br />0.00267 weeks <br />6.145075e-4 months <br /> CST, TS 3.6.2.2 Condition B was entered due to required action and completion time not being met for TS 3.6.2.2 Condition A. The TS 3.6.2.2 Required Action B.1 requires the unit to be in Mode 3 (Hot Shutdown) within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in Mode 4 (Cold Shutdown) within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The BFN, Unit 3, entered Mode 3 on February 25, 2013, at approximately 1313 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />4.995965e-4 months <br /> CST and Mode 4 on February 25, 2013, at approximately 2141 hours0.0248 days <br />0.595 hours <br />0.00354 weeks <br />8.146505e-4 months <br /> CST.

B. Status of structures, components, or systems that were inoperable at the start

of the event and that contributed to the event:

Failure of the reactor feedwater long cycle valve return line connection to the miscellaneous drain header caused a rapid loss of condenser vacuum which caused the turbine trip.

C. Dates and approximate times of occurrences:

February 25, 2013, at 1313 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />4.995965e-4 months <br /> CST Reactor automatically scrammed due to actuation of the RPS from a turbine trip.

Also, TS 3.6.1.3 Condition A was entered due to one or more penetration flow paths with one PCIV inoperable. The BFN, Unit 3, entered Mode 3.

February 25, 2013, at 1324 hours0.0153 days <br />0.368 hours <br />0.00219 weeks <br />5.03782e-4 months <br /> CST The RCIC system was initiated to control reactor water level.

February 25, 2013, at 1326 hours0.0153 days <br />0.368 hours <br />0.00219 weeks <br />5.04543e-4 months <br /> CST The HPCI system was initiated to control reactor pressure.

February 25, 2013, at 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br /> CST The TS 3.6.2.2 Condition A was entered due to suppression pool water level not within limits.

February 25, 2013, at 1422 hours0.0165 days <br />0.395 hours <br />0.00235 weeks <br />5.41071e-4 months <br /> CST Indication was subsequently restored following restoration of containment isolation signals, and the Drywell CAM Inboard Return Isolation Valve was manually isolated.

February 25, 2013, at 1514 hours0.0175 days <br />0.421 hours <br />0.0025 weeks <br />5.76077e-4 months <br /> CST Isolation valves were deactivated to satisfy TS LCO 3.6.1.3 Required Actions.

February 25, 2013, at 1615 hours0.0187 days <br />0.449 hours <br />0.00267 weeks <br />6.145075e-4 months <br /> CST The TS 3.6.2.2 Condition B was entered due to required action and completion time not being met for TS 3.6.2.2 Condition A.

February 25, 2013, at 1649 hours0.0191 days <br />0.458 hours <br />0.00273 weeks <br />6.274445e-4 months <br /> CST The BFN reported event to the NRC.

February 25, 2013, at 2141 hours0.0248 days <br />0.595 hours <br />0.00354 weeks <br />8.146505e-4 months <br /> CST The BFN, Unit 3, entered Mode 4.

D. Manufacturer and model number (or other identification) of each component that failed during the event:

A section of reactor feedwater piping, BFN-3-MISC-003, separated resulting in a loss of condenser vacuum.

E. Other systems or secondary functions affected:

There were no other systems or secondary functions affected.

F. Method of discovery of each component or system failure or procedural error:

Operations personnel observed a scram turbine generator load reject annunciator in the control room resulting in a reactor scram. The reactor feedwater piping separation was discovered by Operations personnel via a remote camera.

G. The failure mode, mechanism, and effect of each failed component, if known:

The failure mode of the feedwater long cycle return line connection to the miscellaneous drain header was due to excessive vibration. The excessive vibration was a result of pipe movement due to seat leakage of one or more of the feedwater long cycle valves. The valve leakage caused flashing of water to steam in the drain header which caused subsequent failure of the miscellaneous drain header pipe wall. This failure caused a loss of vacuum on the turbine which caused the turbine to trip. When the turbine tripped on low condenser vacuum, an automatic reactor scram occurred.

H. Operator actions:

Operations personnel responded in accordance with Emergency Operating Instructions on Low Reactor Water Level. Also, Operations personnel responded in accordance with the Abnormal Operating Instructions for the automatic scram.

I. Automatically and manually initiated safety system responses:

The BFN, Unit 3, reactor automatically scrammed due to the actuation of the RPS from a turbine trip. The MSIVs were manually closed. There was one SRV that was manually operated to maintain reactor pressure due to the unavailability of the Main Turbine Bypass Valves upon loss of condenser vacuum. Reactor water level was controlled with the RCIC system and reactor pressure was controlled with the HPCI system.

Ill. Cause of the event A. The cause of each component or system failure or personnel error, if known:

Direct Cause The direct cause of the event was the failure of the feedwater long cycle return line connection to the miscellaneous drain header due to cyclic fatigue. The feedwater long cycle isolation valves leaked water in the liquid state to low pressure piping resulting in flashing of water to steam. This induced periodic piping movement leading to cyclic fatigue failure.

Root Cause

The system design for Unit 3 Feedwater Long Cycle Return Line does not account for flashing of water to steam. Long cycle return isolation valve leakage established conditions for flashing of water to steam. This caused excessive vibration and subsequent failure of the miscellaneous drain header pipe wall at the elbow connection due to cyclic fatigue. The failure of this passive component established a single point of vulnerability for loss of condenser vacuum and subsequent turbine trip. The turbine trip will cause a reactor scram for plant power in excess of 30 percent.

Contributing Cause Previous corrective actions were not effective in preventing the Unit 3 Feedwater Long Cycle Return line from separating from the miscellaneous drain header.

Previous corrective actions were categorized as lower level Problem Evaluation Reports (PERs). This categorization of PERs was not commensurate with risk.

Recognition of risk would have categorized the corrective actions at a higher level.

Such causal analysis would have identified the inadequate system design to prevent equipment failures as identified in the two examples below.

A previous 2003 level "C" PER 52947 evaluation determined excessive movement of the long cycle piping caused the weld to the miscellaneous drain header to fatigue.

The piping movement was caused by flashing of water to steam in the line due to leakage through one or more of the feedwater long cycle valves. The actions taken focused on addressing the weld.

A previous 2012 level "C" PER 604937 evaluation determined a weld crack leak for BFN, Unit 3, long cycle line from the high pressure feedwater heaters to the condenser was caused by valve seat leakage. This leak was temporarily repaired by Furmanite. The actions taken focused on stopping the leak.

B. The cause(s) and circumstances for each human performance related root cause:

This event was not the result of an active human performance error.

IV. Analysis of the event:

The Tennessee Valley Authority (WA) is submitting this report in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.73(a)(2)(iv)(A) as any event or condition that resulted in manual or automatic actuation of any of the systems listed in 10 CFR 50.73(a)(2)(iv)(B), including: RPS which includes a reactor scram or a reactor trip, general containment isolation signals affecting containment isolation valves in more than one system or MSIVs, HPCI, and RCIC.

During startup from a planned outage on February 25, 2013, catastrophic failure of the Unit 3 Feedwater Long Cycle return line connection to the miscellaneous drain header in Moisture Separator Room caused BFN, Unit 3, to scram.

The Feedwater Long Cycle Valves are solid disc gate valves. These valves serve as isolation between a 1250 psi/400 degrees Fahrenheit environment and a 125 psi/350 degrees Fahrenheit environment with service conditions actually pulling vacuum from the condenser downstream. Flashing of water to steam caused excessive vibration in the long cycle return line piping to the miscellaneous drain header.

Leakage of high pressure water in the liquid state to low pressure piping resulted in flashing of water to steam. This induced periodic piping movement leading to cyclic fatigue failure. Leakage establishes conditions for flashing of water to steam, which was not adequately addressed in the design of the downstream piping and piping supports for actual service conditions.

Since the piping system downstream of the valves was not designed to control where flashing occurs, flashing caused excessive vibration and subsequent failure of the miscellaneous drain header pipe wall at the elbow connection due to cyclic fatigue.

V. Assessment of Safety Consequences

The RPS provides timely protection against the onset and consequences of conditions that threaten the integrity of the fuel barrier and the nuclear system process barrier, i.e.

fuel cladding and reactor coolant system pressure boundary respectively. The RPS is designed such that no single failure can prevent a reactor scram, and the RPS is designed to automatically shutdown the reactor based on parameters which deviate from normal.

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:

The MSIVs were manually closed. There was one SRV that was manually operated to maintain reactor pressure due to the unavailability of the Main Turbine Bypass Valves due to the loss of condenser vacuum. All systems responded as expected to the turbine trip. No ECCS or RCIC system reactor water level initiation set points were reached. Reactor water level was controlled by the RCIC system and reactor pressure was controlled with the HPCI system.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shutdown the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:

All safety systems remained available during this event and operated as designed.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:

There were no safety systems rendered inoperable as a result of this event.

Therefore, TVA concluded that there was minimal safety significance for this event.

VI. Corrective Actions

Corrective Actions are being managed by TVA's corrective action program under PERs 516455 and 687732.

Immediate Corrective Actions

A Temporary Alteration Control Form 3-13-002-003 was initiated to cut and cap the Feedwater Long Cycle Lines downstream of each feedwater long cycle valve and upstream of the miscellaneous drain header.

Corrective Actions to Prevent Recurrence

For BFN, Units 1, 2, and 3, the Feed Water Long Cycle lines downstream of each Feed Water Long Cycle isolation valve and upstream of the Miscellaneous Drain Header will be redesigned with a valve and piping configuration appropriate for the specified application.

VII. Additional Information:

A. Previous similar events at the same plant:

A search of BFN Licensee Event Reports (LERs) for Units 1, 2, and 3 for the last several years identified LER 50-296/2013-002-00, Manual Actuation of Reactor Core Isolation Cooling System During Reactor Shutdown. This LER identified a similar condition concerning the reactor feedwater piping separation on the feedwater long cycle lines. The analysis for that LER was ongoing at the time of this event; therefore, the corrective actions for that LER would not have prevented this event from occurring.

A search was performed on the BFN corrective action program. Similar PERs related to the condition which caused the event reported in this LER are PERs 41131, 52947, and 604937.

PER 41131 states, "Chemistry identified a threat to the integrity of the welded pipe connection of the 8 inch long cycle return line at the miscellaneous drain header and potential condenser vacuum issues with movement observed from the line giving a strong indication of long cycle valve leakage with subsequent flashing occurring in the long cycle return line." The PER 41131 was closed to PER 52947 which identified that excessive movement of the long cycle piping caused the weld to the miscellaneous drain header to fatigue. The piping movement was caused by flashing in the line due to leakage through one or more of the feedwater long cycle valves. However, the corrective actions did not address the risk of failing to repair and maintain the valves that were the cause of the pipe movement which resulted ultimately in the failure of the 8 inch long cycle feedwater return line at the tie into the 24 inch miscellaneous drain header.

PER 604937 describes a weld crack leak for BFN, Unit 3, long cycle line from the high pressure feedwater heaters to the condenser caused by valve seat leakage.

This leak was temporarily repaired by Furmanite. The actions taken focused on stopping the leak.

As a result of not addressing the actual failure mode and recognizing the risk associated with the long cycle return valves, BFN missed an opportunity to utilize available Operating Experience to prevent this event.

B. Additional Information:

There is no additional information.

C. Safety System Functional Failure Consideration:

In accordance with Nuclear Energy Institute (NEI) 99-02, this condition is not considered a safety system functional failure.

D. Scram with Complications Consideration:

In accordance with NEI 99-02, this event is considered an unplanned scram with complications.

VIII. COMMITMENTS

There are no commitments.