05000321/LER-2009-003, Regarding Work Activities on the Main Turbine Cause as Unexpected Turbine Reset Resulting in a Group 1 Isolation
| ML091700630 | |
| Person / Time | |
|---|---|
| Site: | Hatch  |
| Issue date: | 06/19/2009 |
| From: | Madison D Southern Nuclear Operating Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| NL-09-0992 LER 09-003-00 | |
| Download: ML091700630 (5) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 3212009003R00 - NRC Website | |
text
Dennis R, Madison Vice President - Hatch Southern Nuclear Operating Company, Inc.
Plant Edwin I, Hatch 11028 Hatch Parkway North Baxley, Georgia 31513 Tel 912,537,5859 Fax 9123662077 SOUIHERNA COMPANY June 19, 2009 Docket No.:
50-321 NL-09-0992 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C. 20555-0001 Edwin I. Hatch Nuclear Plant Licensee Event Report Work Activities On The Main Turbine Cause An Unexpected Turbine Reset Resulting In A Group 1 Isolation Ladies and Gentlemen:
In accordance with the requirements of 10 CFR 50.73(a)(2)(iv)(A), Southern Nuclear Operating Company is submitting the enclosed Licensee Event Report (LER) concerning an unexpected Group 1 valve isolation.
This letter contains no NRC commitments. If you have any questions, please advise.
Sincerely, fJ~;n?a~
D. R. Madison Vice President - Hatch DRM/MJK/
Enclosure: LER 1-2009-003 cc:
Southern Nuclear Operating Company Mr. J. T. Gasser, Executive Vice President Ms. P. M. Marino, Vice President - Engineering RTYPE: CHA02.004 U. S. Nuclear Regulatory Commission Mr. L. A. Reyes, Regional Administrator Mr. R. E. Martin, NRR Project Manager - Hatch Mr. J. A. Hickey, Senior Resident Inspector - Hatch
NRC FORM 366 (9-2007)
PRINTED ON RECYCLED PAPER NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION (9-2007)
LICENSEE EVENT REPORT (LER)
APPROVED BY OMB: NO. 3150-0104 EXPIRES: 08/31/2010
, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 1. FACILITY NAME Edwin I. Hatch Nuclear Plant Unit 1
- 2. DOCKET NUMBER 05000 321
- 3. PAGE 1 OF 4
- 4. TITLE Work Activities On The Main Turbine Cause An Unexpected Turbine Reset Resulting In A Group 1 Isolation
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED MONTH DAY YEAR YEAR SEQUENTIAL NUMBER REV NO.
MONTH DAY YEAR FACILITY NAME DOCKET NUMBER 05000 05 08 2009 2009 - 003 -
0 06 19 2009 FACILITY NAME DOCKET NUMBER 05000
- 9. OPERATING MODE 3
- 10. POWER LEVEL 000
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply) 20.2201(b) 20.2203(a)(3)(i) 50.73(a)(2)(i)(C) 50.73(a)(2)(vii) 20.2201(d) 20.2203(a)(3)(ii) 50.73(a)(2)(ii)(A) 50.73(a)(2)(viii)(A) 20.2203(a)(1) 20.2203(a)(4) 50.73(a)(2)(ii)(B) 50.73(a)(2)(viii)(B) 20.2203(a)(2)(i) 50.36(c)(1)(i)(A) 50.73(a)(2)(iii) 50.73(a)(2)(ix)(A) 20.2203(a)(2)(ii) 50.36(c)(1)(ii)(A) 50.73(a)(2)(iv)(A) 50.73(a)(2)(x) 20.2203(a)(2)(iii) 50.36(c)(2) 50.73(a)(2)(v)(A) 73.71(a)(4) 20.2203(a)(2)(iv) 50.46(a)(3)(ii) 50.73(a)(2)(v)(B) 73.71(a)(5) 20.2203(a)(2)(v) 50.73(a)(2)(i)(A) 50.73(a)(2)(v)(C)
OTHER 20.2203(a)(2)(vi) 50.73(a)(2)(i)(B) 50.73(a)(2)(v)(D)
Specify in Abstract below or in NRC Form 366A
- 12. LICENSEE CONTACT FOR THIS LER FACILITY NAME Edwin I. Hatch / Kathy Underwood, Performance Improvement Supervisor TELEPHONE NUMBER (Include Area Code) 912-537-5931 CAUSE SYSTEM COMPONENT MANU-FACTURER REPORTABLE TO EPIX
CAUSE
SYSTEM COMPONENT MANU-FACTURER REPORTABLE TO EPIX
- 14. SUPPLEMENTAL REPORT EXPECTED YES (If yes, complete 15. EXPECTED SUBMISSION DATE)
NO
- 15. EXPECTED SUBMISSION DATE MONTH DAY YEAR ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)
On May 8, at 1515 EDT, Unit 1 was in Mode 3, hot shutdown, when a Group 1 isolation signal was received. All eight Main Steam Isolation Valves (MSIV) and appropriate small bore valves closed as designed. The signals received were a valid main condenser low vacuum signal coincident with a main turbine reset signal which opened a turbine stop valve. The reset of the turbine was an unanticipated result of ongoing mark VI turbine control system processor repair work. The reactor was in hot shutdown for nuclear instrument repair. The condition causing the turbine reset was cleared and the turbine was tripped with all valves closed. The Group 1 trip was reset and MSIVs were opened.
Inadequate information on the Mark VI logic concerning the fact that a turbine trip reset occurs when the S1 core processor is rebooted caused this event. This reboot resets the turbine trip, opens the turbine stop valves, and causes Group 1 valve isolation when a low condenser vacuum condition exists. In addition, procedure 57GM-MIC-005-1 was not active when this evolution took place. This procedure prevents a turbine reset by providing a hard turbine trip logic seal-in.
A new procedure will be developed that addresses actions to be taken and potential consequences when a reboot of the S1 processor is to be performed.
(If more space is required, use additional copies of NRC Form 366A)
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor Energy Industry Identification System codes appear in the text as (EIIS Code XX).
DESCRIPTION OF EVENT
On January 10, 2009 quarterly turbine control valve (TCV) (EIIS Code TA) fast closure surveillance on 1N30F012 was being performed. During that surveillance a Servo suicide alarm was received on control valve #4 (TCV4). Maintenance personnel investigated and determined that when Test was selected on the turbine Mark VI human-machine interface (HMI) (EIIS Code TG) during the fast closure surveillance, the valves fast acting solenoid was observed fired, resulting in TCV4 valve position feedback that exceeded the suicide set point in the closed direction. The valve over traveled to negative 9.5 percent travel which exceeds its negative 3.5 percent Min Pos value +/-5 percent suicide set-point values. This resulted in initiating a servo suicide alarm and the valve loosing functionality. Since the reactor was at less than 72 percent power, the alarm was cleared by the use of the master reset of the Mark VI system and TCV4 returned to service for repair offline.
On May 5, 2009 during a planned outage, site maintenance attempted to calibrate 1N30F012 TCV4 per site procedures. When TCV4 valve was stroked no problems were observed.
TCV4 has a triple redundant Linear Voltage Differential Transmitter (LVDT), whose function is to provide valve position feedback to the Mark VI S1 core processors. The valves LVDT position values recorded during calibration was documented as changed slightly. After calibration, maintenance procedures required the Mark VI controllers to be updated with any new values from the surveillance. While attempting to update the data to Mark VI Steam Generation (S1) core processors, an error message was received. An attempt was made to validate, build, and download to the S1 Cores processors simultaneously and individually with no success. A time out was called to develop a corrective action plan.
The main turbine Electro-Hydraulic Control (EHC) (EIIS Code TG) system employs a General Electric (G.E.) Type Mark VI controller. The Mark VI system is a dual triple modular redundant system, one controller for the turbine steam generation (S1) controls while another for reactor pressure controls (P1) whose function is to maintain a constant reactor pressure.
The system is a triple modular system because the S1 and P1 each contain three redundant processors. R core, S core, & T core processors make up the S1 controller. The S core processor was initiating the error message during the download. Because of the error message Innovation Series Controller error this prevented the validation, build, and download of the appropriate updated values to each core processor. The error message was discussed with the G.E. field engineer representative and it was decided that the S1 core needed a complete reboot to remove the error. Work instructions were generated that turned off all power to the S1 cores and protective cores redundant processors in sequence.
The processors were rebooted in the reverse sequence. Before the plan was implemented, site and G.E. personnel reviewed the developed work instructions, all available Mark VI control logic was reviewed, the task was performed successfully on the Mark VI suitcase simulator, and Mark VI diagnostic alarms were reviewed. (9-2007)
LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET U.S. NUCLEAR REGULATORY COMMISSION
- 1. FACILITY NAME
- 2. DOCKET
- 6. LER NUMBER
- 3. PAGE YEAR SEQUENTIAL NUMBER REVISION NUMBER Edwin I. Hatch Nuclear Plant Unit 1 05000321 2009 003 0
3 OF 4
PRINTED ON RECYCLED PAPER On 5/08/2009 at 15:15, while Hatch Unit 1 was in Hot Shutdown, a Group 1 primary containment isolation signal was received. The direct cause of the isolation is due to simultaneously removing power to the S1 cores and reboot. When all S1 & Protective core processors were powered down simultaneously, controls were lost to the turbine control valve, stop valves, and intercept valves. After a reboot of the Mark VI S1 Cores, the Mark VI system logic returned to the logics shelf state. The shelf state for many of the logic circuit seal-ins, commands, and bypasses are zero False. Therefore, if a logic seal in was true before the reboot, it became false afterwards and would require manual actions to restore.
This is what occurred in this event; when the turbine was tripped, there was a logic circuit turbine trip seal -in keeping the turbine from resetting. After the reboot, this logic seal-in unlatched and returned to its shelf state, which caused the main turbine trip to reset. From discussions with the G.E. vendor, when the turbine trip unlatched and a No Closed Valve Mark VI logic command became false (shelf state), this provided the permissive for the #2 TSV to cycle open. With both the main turbine reset and TSV open along with low condenser vacuum (EIIS Code SG) due to the reactor being in hot shutdown a permissive existed for a Group 1 isolation signal.
CAUSE OF EVENT
Inadequate information on the Mark VI logic concerning the fact that a turbine trip reset occurs when the S1 core processor is rebooted caused this event. Installation of a hard turbine trip seal-in that would not reset when the S1 core processor is rebooted, would have prevented the Group 1 isolation. This should have been incorporated into the repair plan before the power was removed from the S1 cores processor. It was not incorporated due to lack of knowledge by the vendor and SNC personnel concerning response of the Mark VI controller when a reboot was performed.
REPORTABILITY ANALYSIS AND SAFETY ASSESSMENT This event is reportable per 10 CFR 50.73(a)(2)(iv)(A) because unplanned actuations of safety feature systems listed in 10 CFR 50.73 occurred. In this instance, a Group 1 isolation occurred.
The Condenser Vacuum - Low Function is provided to prevent over pressurization of the main condenser in the event of a loss of the main condenser vacuum. Since the integrity of the condenser is an assumption in offsite dose calculations, the Condenser Vacuum - Low Function is assumed to be operable and capable of initiating closure of the MSIVs (EIIS Code SB). The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture of the diaphragm installed to protect the turbine exhaust hood, thereby preventing a potential radiation leakage path following an accident. Condenser vacuum pressure signals are derived from four pressure switches that sense the pressure in the condenser. Four channels of Condenser Vacuum -
Low Function are available and are required to be operable to ensure that no single instrument failure can preclude the isolation function. The Allowable Value is chosen to prevent damage to the condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis. As noted in the technical specifications, the channels are not required to be operable in Modes 2 and 3 when all turbine stop valves (TSVs) are closed, since the (9-2007)
LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET U.S. NUCLEAR REGULATORY COMMISSION
- 1. FACILITY NAME
- 2. DOCKET
- 6. LER NUMBER
- 3. PAGE YEAR SEQUENTIAL NUMBER REVISION NUMBER Edwin I. Hatch Nuclear Plant Unit 1 05000321 2009 003 0
4 OF 4
PRINTED ON RECYCLED PAPER potential for condenser over pressurization is minimized. Switches are provided to manually bypass the channels when all TSVs are closed. This Function isolates the Group 1 valves.
In this event, the bypass of the low condenser vacuum isolation signal was removed when the main turbine stop valves opened following reset of the turbine. The turbine logic system was reset by the resting of the Mark VI turbine control system. With the logic bypass removed, a Group 1 isolation signal was generated per design and the open Group 1 primary containment isolation valves closed as required. The Group 1 isolation logic functioned as designed and would have prevented over pressurization of the condenser had it been required to do so.
Based on this analysis, it is concluded that this event had no adverse impact on nuclear safety. This analysis applies to all operating conditions.
CORRECTIVE ACTIONS
A new procedure will be developed that addresses actions to be taken and potential consequences when a reboot of the S1 processor is to be performed. This will be tracked in the Corrective Action Program.
ADDITIONAL INFORMATION
Other Systems Affected: None
Failed Components Information
None Commitment Information: This report does not create any new permanent licensing
commitments
Previous Similar Events
There are no similar events within the past two years in which a group one isolation was received as a result of mark VI Turbine Control System work.