05000296/LER-2014-002
| Browns Ferry Nuclear Plant, Unit 3 | |
| Event date: | 05-06-2014 |
|---|---|
| Report date: | 07-07-2014 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| 2962014002R00 - NRC Website | |
I. Plant Operating Conditions Before the Event
Browns Ferry Nuclear Plant (BFN), Unit 3, was in Mode 1 at approximately 100 percent power.
II. Description of Events
A. Event:
On May 6, 2014, at approximately 0830 Central Daylight Time (CDT), the Browns Ferry Nuclear Plant (BFN) Unit 3 reactor automatically scrammed as a result of an Anticipated Transient Without Scram/Alternate Rod Insertion (ATWS/ARI) [JC] signal generated during functional testing of reactor water level instrumentation. The scram air header was depressurized through the ATWS/ARI valves causing all control rods to insert into the core. The ATWS/ARI signal also simultaneously opened the Recirculation Pump Trip (RPT) breakers, tripping both Recirculation pumps. Prior to the event, the reactor was operating at 100 percent power. A Core and Containment Cooling Systems Analog Trip Unit Functional Test was in progress. Following receipt of the ATWS/ARI signal, all plant systems performed as required.
The loss of both Recirculation pumps along with reduced core flow caused a reactor water level transient that lowered level below the Reactor Protection System (RPS) [JC] trip setpoint (+2 inches), resulting in a full reactor scram signal. Primary Containment Isolation System [JM] Groups 2, 3, 6, and 8 containment isolation and initiation signals were received. Upon receipt of these signals all required components actuated as required. Prior to the full reactor scram, reactor power was 2.1 percent due to all control rods being inserted by the ATWS/ARI initiation ten seconds earlier.
The Main Steam Isolation [SB] Valves remained open with main turbine bypass valves controlling reactor pressure. The Reactor Feedwater [SJ] pumps remained in service to control and maintain reactor water level.
B. Status of structures, components, or systems that were inoperable at the start
of the event and that contributed to the event:
There were no structures, components, or systems that were inoperable at the start of the event and that contributed to the event.
C. Dates and approximate times of occurrences:
May 6, 2014, at 0406 CDT Core and Containment Cooling Systems Analog Trip Unit Functional Tests Surveillance started.
May 6, 2014, at 0830 CDT May 6, 2014, at 1227 CDT ATWS Channel A signal received on Unit 3 and control rod insertion commenced due to the actuation of the ARI solenoid valves by the ATWS signal. The ATWS/ARI signal also simultaneously opened the Recirculation pump trip breakers, tripping both Recirculation pumps.
Core and Containment Cooling Systems Analog Trip Unit Functional Testing stopped.
The BFN reported the event to the NRC.
D. Manufacturer and model number (or other identification) of each component that failed during the event:
No component failures were identified that occurred during the event. However, as a part of troubleshooting and further analysis, the Automatic Trip Unit (ATU) power supply and slave card were replaced due to the inability to eliminate either as the causing component at that time.
E. Other systems or secondary functions affected:
There were no other systems or secondary systems affected.
F. Method of discovery of each component or system failure or procedural error:
During the performance of a Functional Test on the Unit 3 reactor water level instrumentation, the Anticipated Transient Without a Scram Recirculation Pump Trip (ATVVS-RPT) relay unexpectedly actuated resulting in dual Recirculation Pump trip.
G. The failure mode, mechanism, and effect of each failed component, if known:
During the investigation, it was determined that the ATWS low reactor water level ATU cards initiated a voltage transient that actuated the ATWS high pressure trip.
H. Operator actions:
There were no immediate operator actions since all automatic protective functions performed as required. However, operators entered plant procedures 3-A0I-100-1, 3-E0I-1, 3-01-2, 3-01-47, and 3-01-75 to address the plant transients.
I. Automatically and manually initiated safety system responses:
Following the receipt of the ATWS/ARI signal, all systems performed as required.
III. Cause of the event
A. The cause of each component or system failure or personnel error, if known:
Direct Cause The direct cause of the Unit 3 automatic reactor scram on May 6, 2014, was the spurious energizing of ATWS relay 3-58C5 during simulation of a low reactor water level.
Root Cause
The root cause was that the ATWS low reactor water level ATU cards initiated a voltage transient that actuated the ATVVS high reactor pressure trip due to a design anomaly.
B. The cause(s) and circumstances for each human performance related root cause:
There was no human performance related root cause.
IV. Analysis of the event:
The Tennessee Valley Authority (WA) is submitting this report in accordance with 10 CFR 50.73(a)(2)(iv)(A), as any event or condition that resulted in manual or automatic actuation of any of the systems listed in paragraph (a)(2)(iv)(B), reactor protection and containment isolation systems.
On May 06, 2014 at 0830 CDT, Unit 3 ATVVS/ARI was unexpectedly initiated during the performance of 3-SR-3.3.5.1.2 (ATU A). The initiation occurred as a reactor water level switch (3-LS-3-58A1) was being functionally tested by simulating a lowering reactor water level. Contrary to the test intent, once the setpoint was reached ATWS initiation occurred. As a result the scram air header was depressurized through the ATWS/ARI valves, causing all control rods to insert into the core. The ATWS/ARI signal also simultaneously opened the RPT breakers, tripping both pumps. The loss of both Recirculation pumps along with reduced core flow caused a reactor water level transient that lowered level below the RPS trip setpoint (+2 inches), resulting in a full reactor scram signal. Prior to the event, reactor power was 2.1 percent due to all control rods being inserted by the ATWS/ARI initiation ten seconds earlier. Following receipt of the ATWS/ARI signal, all plant systems performed as required.
Immediately after the plant trip, testing was stopped with test equipment configuration unchanged. Eleven minutes after the scram Maintenance supervision verified all test equipment was in the expected position and all procedure steps were performed as written. No active human performance errors were identified. The test procedure was also reviewed with no deficiencies identified. The test equipment used during performance of the Surveillance was tested and found to be within calibration and functioning correctly. Post-scram testing/troubleshooting revealed a number of potential causes.
Testing confirmed that simultaneous actuation of the high reactor pressure relays via a voltage transient as the failure that occurred and is the root cause. Testing validated that a General Electric (GE) ATU card in one circuit could transmit a spurious voltage signal (crossover) to other cards in a separate circuit when the card under test is tripped (in this case by simulating a low water level as part of the functional test). The signal produced by the actuation of the GE ATU cards and subsequent actuation of the low reactor water level relays was of sufficient magnitude and duration to trip the high reactor pressure relays due to the close proximity of the trip setpoint and normal on-line indication for reactor pressure (6-7 percent). The high reactor pressure relays are also more susceptible to this type of perturbation because they are instantaneous, unlike the low reactor water level relays, which have a time delay of 750 milliseconds that allows short- lived transients to pass without initiating ATVVS.
The production of the voltage transient has been isolated to an anomaly of the GE master/slave cards in the ATWS circuitry. Discussion with GE confirmed this anomaly is a characteristic of the cards and not necessarily a defect. However, a defect could not be ruled out; so those cards will be replaced with new ones as a precaution. Rosemount cards have not shown the same susceptibility and are the only other card manufacturer used in this application at BFN and do not need to be replaced. The GE cards were utilized to add diversity to the reactor trip logic.
The absence of the ATWS Test Switch in the ATU functional tests was evaluated and determined to not be causal to the event. The purpose of the test switch is to prevent actuation of ATWS during testing that would produce an ATWS initiation signal (i.e.
ATVVS logic tests). The surveillance being run in this event was a functional test that affects only half of the logic and is not intended to actuate the ATWS relay. Review of external and internal operating experience has not found another instance of the phenomenon observed for a similar event. Therefore, the use of the test switch was not considered previously and should not have been considered based on accepted industry test practices and operational experience.
V. Assessment of Safety Consequences
There were no actual safety consequences associated with this event as the plant response was within expected design values and the plant equipment functioned properly during and after the scram.
Based on the discussion above, the safety significance of this event is low and the event did not pose a threat to the health and safety of the public or plant personnel.
Nuclear Safety was maintained by the automatic protective functions in the circuitry that resulted in the scram followed by appropriate operator actions based on procedural requirements.
A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:
The A and B channels of ATWS are redundant and operate identically. Therefore, there is no other component that could have performed the same function available.
B. For events that occurred when the reactor was shut down, availability of systems or components needed to shutdown the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:
The BFN Unit 3 was not shut down when this event occurred.
C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:
This event did not render a train of a safety system inoperable.
VI. Corrective Actions
Corrective Actions are being managed by TVA's corrective action program under Problem Evaluation Report (PER) 881051.
Immediate Corrective Actions
The ATU power supply was replaced along with the slave card due to the inability to eliminate either as the causing component at that time.
Interim Corrective Actions
Revise Core and Containment Cooling Systems Analog Trip Unit Functional Test procedures to include use of the ATVVS Test Switch and the High Reactor Water Level Bypass Switch to protect the plant from inadvertent actuation during testing.
Corrective Actions to Prevent Recurrence or to Reduce Probability of Similar Events Occurring in the Future
- Install time delay relays in association with the reactor pressure ATVVS circuit on BFN Units 1, 2, and 3.
- Replace the GE Master and Slave ATU cards associated with the initiating event.
VII. Additional Information:
A. Previous similar events at the same plant:
A search of the BFN self-assessment data base was conducted. The search was for issues relevant to ATWS-RPT system SCRAMS. The period between 2010 and 2014 was searched. The search of the self-assessment database yielded no results applicable to this issue.
B. Additional Information:
There is no additional information.
C. Safety System Functional Failure Consideration:
In accordance with Nuclear Energy Institute (NEI) NEI 99-02, "Regulatory Assessment Performance Indicator Guideline," this event is not considered a safety system functional failure.
D. Scram with Complications Consideration:
This event did not result in an unplanned scram with complications because:
1. RPS actuation established a shutdown rod pattern for a cold clean core; 2. Pressure control was able to be established following the initial transient; 3. Power was not lost to any Class 1 E Emergency / Engineered Safety Feature bus; 4. A Level 1 Injection signal was not received; 5. Main Feedwater was available or recoverable using approved plant procedures during the scram response; and 6. Following initial transient, stabilization of reactor pressure/level and drywell pressure did not require remaining in the Emergency Operating Procedures.
VIII. COMMITMENTS
There are no commitments.