05000327/LER-2003-001
| Sequoyah Nudear Plant (Son) Unit 1 | |
| Event date: | 08-28-2003 |
|---|---|
| Report date: | 10-27-2003 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 3272003001R00 - NRC Website | |
I. P PLANT CONDITION(S) Unit 1 was in power operation at approximately 100 percent reactor power.
IL D DESCRIPTION OF EVENT
A. Event:
On August 28, 2003, at approximately 1603 Eastern daylight time (EDT), main control room (MCR) operators initiated a manual reactor trip as a result of a loss of load event. Preceding the manual reactor trip, plant personnel were performing quarterly simulated oil trip tests [EllS Code IT] on the main turbine. During performance of the thrust bearing trip test section of the procedure, a main generator [EllS Code EL] trip occurred resulting in a 100-percent loss of load to the unit. MCR operators diagnosed the plant condition, determined that a loss of load event had occurred, tripped the reactor, and took actions to stabilize and maintain the unit in hot shutdown, Mode 3.
The turbine tripped as a result of the manual reactor trip. Based on information that the reactor had not tripped and the successful manual trip, MCR operators made an Alert emergency declaration (failure of reactor protection).
B. Inoperable Structures, Components, or Systems that Contributed to the Event:
The turbine electro-hydraulic control system auto-stop oil (pressure low) pressure switch was inadvertently isolated (pressure switch isolation valve was closed) during recent Unit 1 Cycle 12 refueling outage maintenance activities. The pressure switch being isolated caused the low pressure condition thereby establishing part of the logic required for a main generator trip. During performance of the test procedure, the thrust bearing trip was actuated, in accordance with the test procedure, establishing main generator trip logic.
C. Dates and Approximate Times of Major Occurrences:
June 17, 2003 at 0532 EDT August 28, 2003 at 1603 EDT August 28, 2003 at 1603 EDT Unit 1 Cycle 12 refueling outage was completed and the unit was returned to service.
The thrust bearing wear pressure switch is actuated as expected for the test. Generator breakers open and the main generator trips.
MCR operators initiate a manual reactor trip. The reactor trip initiates a turbine trip.
August 28, 2003 at 1611 EDT August 28, 2003 at 1618 EDT MCR operators closed the main steam isolation valves based on indicated steam flow on the four steam generator loops.
Alert is declared based on an anticipated transient without scram (ATWS).
D. Other Systems or Secondary Functions Affected:
Following the reactor trip, MCR operators noted reactor coolant system (RCS) T„9 to be 545 degrees Fahrenheit (F) and decreasing coincident with one steam dump valve indicating open in mid-position and steam generator steam flow indicators showing between 0.3 and 0.6 million pounds per hour flow. Consistent with procedures, operators dosed the main steam isolation valve (MSIV) in each of the four steam generator loops. Flow indication remained following MSIV closure. Evaluation of the condition determined that the observed flow indication was consistent with instrument loop indication error. Loop flow indication error is 5 to 11 percent of calibrated span for flow rates above 25 percent of calibrated span. Loop flow indication error increases for flow rates below 25 percent of calibrated span. Subsequent steam dump valve troubleshooting activities determined that the valve had closed.
E. Method of Discovery:
The main generator trip and loss of load was observed by operators monitoring the MCR panels.
F. Operator Actions:
MCR operators responded to the event in accordance with plant procedures. They promptly diagnosed the plant condition (main generator breakers open, zero megawatt output, and control rods stepping in at a rapid rate) as a loss of load event.
MCR operators manually tripped the reactor and took actions to stabilize and maintain the unit in hot standby, Mode 3.
G. Safety System Responses:
The plant safety system responses during and after the transient and unit trip were bounded by the responses described in the Final Safety Analysis Report (FSAR).
Ill. � CAUSE OF THE EVENT
A. Immediate Cause:
The immediate cause of the event was isolation of the auto-stop oil pressure switch.
As a result of the pressure switch isolation valve being closed, part of the main generator trip logic was established. When the remaining condition was met during testing, the main generator tripped.
B. Root Cause:
The event analysis identified two likely causes: 1) failure to properly implement the valve verification process, or 2) failure to maintain a configuration control process.
Work documents from activities performed during the Unit 1 Cycle 12 refueling outage on the auto-stop oil pressure switch were reviewed and interviews were conducted with the individuals that performed those activities. This review determined that configuration control of the pressure switch isolation valve was not properly accomplished and verification practices were poor. The specific activity that caused the valve mis-position was not identified.
C. Contributing Factor:
Contributing to the event were missed opportunities that occurred before start-up from the Unit 1 Cycle 12 refueling outage.
During outage recovery there was a problem with latching the turbine. Action was taken to inspect and analyze the condition at the turbine. This action progressed to verifying valve positions and manipulating at least one valve without documenting the out-of-position condition. As a result, no consideration was made for verification of other valve positions on the turbine.
During turbine trip block removal post maintenance testing, a computer point actuated. The computer point actuation indicated that the generator received a trip signal. However, the trip signal did not result in an event because the main generator breakers were already open. Review of the oil trip test procedure determined that the procedure did not require the computer point be checked. The procedure contained a note that alarms could be received which referenced this computer point. The procedure was not adequate to detect the generator trip signal.
IV. ANALYSIS OF THE EVENT
The plant transient initiating event was a main generator trip and loss of load. As a result of the event initiating condition, a direct turbine trip was not generated. Once the main generator disconnected from the grid, the plant initially responded as if there was a step load change. Reactor power started to decrease and steam dump valves opened. Reactor power reached approximately 85 percent when the reactor was manually tripped. Following the reactor trip, reactor power quickly decreased to the level of decay heat. Reactor coolant system (RCS) temperature was at its program value of 578.2 degrees F at the time of the main generator trip. Because of turbine load rejection, RCS Tavg increased to 588 degrees F before the reactor trip. With the loss of nuclear heat generation and the introduction of cold auxiliary feedwater, RCS temperature decreased to its no-load value of 547 degrees F approximately seven minutes following the reactor trip. Minimum RCS Taw for the transient was 544 degrees F. Adequate shutdown margin was maintained and emergency boration was not required. Therefore, RCS temperature remained within technical specification and safety analysis report requirements during the event Reviews of the annunciator and sequence of events reports determined that the reactor protection system responded as designed to the main generator trip. The result of the main generator trip was a 100-percent loss of load, for approximately 25 seconds, until the MCR operators manually tripped the reactor. As designed, neither the reactor protection system nor the turbine trip protection systems received an input requiring a trip before operator action. For this reason, there was no malfunction or failure of the reactor protection system; therefore, this was not an ATWS event.
The plant safety system responses during and after the unit trip were bounded by the responses described in the SON final safety analysis report.
V. ASSESSMENT OF SAFETY CONSEQUENCES
Based on the above Analysis of The Event, this event did not adversely affect the health and safety of plant personnel or the general public.
VI. F CORRECTIVE ACTIONS
A. Immediate Corrective Actions:
Immediate actions taken were to verify valve positions identified in the extent of condition evaluation. The primary focus of the extent of condition evaluation was work activities performed by instrument maintenance during the Unit 1 Cycle 12 refueling outage. Review was performed of outage design changes that were implemented by more than one organization that removed and reinstalled large portions of plant equipment and that were associated with trip sensitive instrumentation. Technical specifications were reviewed to determine if mis- configuration of technical specification instruments would not be self-revealing or not verified by channel checks. A review was performed of Unit 1 turbine side instruments that have the potential to defeat coincident logic if they were isolated from the process system and which do not alarm when actuated or defeated. Based on results of each of the reviews, valve position verification walkdowns were performed.
Additionally, valve positions were verified for the valves in the turbine front standard.
No other mis-positioned valves were identified.
A design change was initiated to add visual indication of auto-stop oil pressure switch actuation. The change was implemented on Unit 1 prior to restart of the unit. An action is contained in the corrective action process for implementation on Unit 2.
The turbine oil trip test procedure was revised to remove the reference to computer alarms that `may come in.
B. Corrective Actions to Prevent Recurrence:
Individuals involved with inadequate verification and configuration control of auto- stop oil pressure switches were counseled and appropriate personnel actions were administered.
Site personnel were provided with event lessons learned that reinforced configuration control requirements.
VII. ADDITIONAL INFORMATION
A. F Failed Components:
None B. Previous LERs on Similar Events:
A review of previous reportable events for the past three years did not identify any similar events.
C. Additional Information:
The event corrective action document contains actions to address:
- operator understanding of main steam flow indication error below 25 percent flow conditions.
- reinforcement of initiation of corrective action documentation for out of position components
- revision of the turbine oil test procedure to check that appropriate annunciators actuate during the testing activities.
D. Safety System Functional Failure:
This event did not result in a safety system functional failure in accordance with 10 CFR 50.73(a)(2)(v).
E. Loss of Normal Heat Removal Consideration This event did not result in a loss of normal heat sink because main steam isolation and steam dump valves were available.
VIII. COMMITMENTS
None.