05000338/LER-2015-002
| North Anna Power Station, Unit 1 | |
| Event date: | 04-02-2015 |
|---|---|
| Report date: | 09-03-2015 |
| 3382015002R01 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
SE JUEmbil'IR AL 1.0 DESCRIPTION OF THE EVENT On April 2, 2015, at 0426 hours0.00493 days <br />0.118 hours <br />7.043651e-4 weeks <br />1.62093e-4 months <br />, with Unit 1 operating at 100 percent power, a manual reactor trip was initiated due the inability to maintain main generator (EIIS System TL, Component GEN) voltage in specification. Prior to the initiation of the manual reactor trip, the operations crew had entered abnormal procedure 1-AP-26, Voltage Regulator Failure, due to the Unit 1 main generator voltage being high. Several control room annunciators (EIIS Component ANN) had locked in with the generator output greater than 600 MVARs out and manual actions to lower voltage were ineffective. As a result, the manual reactor trip was initiated. This also resulted in a turbine trip.
Troubleshooting subsequently revealed that the output from the number 2 gate firing module (GFM) (EIIS Component IMOD) in the firing circuit downstream of the main generator automatic voltage regulator (AVR) (EIIS Component RG) failed high causing the generator output to be greater than 600 MVARs out.
Following the reactor trip the Reactor Protection System (RPS) and all Engineered Safety Feature Actuation System (ESFAS) (EMS System JE) equipment actuated as designed, including the Auxiliary Feedwater (AFW) pumps (EIIS System BA, Component P). The control room operators responded to the event in accordance with emergency procedure 1-E-0, Reactor Trip or Safety Injection. The operators then stabilized the plant using 1-ES-0.1, Reactor Trip Recovery.
At 0655 hours0.00758 days <br />0.182 hours <br />0.00108 weeks <br />2.492275e-4 months <br />, a 4-hour Non-Emergency Report was made to the NRC in accordance with 10 CFR 50.72(b)(2)(iv)(B) for "an event causing actuation of the Reactor Protection System when the reactor is critical" and an 8-hour report was also made in accordance with 10 CFR 50.72(b)(3)(iv)(A) for "an event causing actuation of the Auxiliary Feedwater System (AFW).
2.0 SIGNIFICANT SAFETY CONSEQUENCES AND IMPLICATIONS No significant safety consequences resulted from this event because the RPS and ESFAS systems actuated as designed following initiation of the manual trip. The health and safety of the public were not affected by this event.
North Anna Power Station, Unit 1 05000338 3.0 CAUSE The direct cause of the overexcitation of the generator was due to the single failure of a GFM #2 which resulted in a high output to the power amplifier drawer. GFM #2 failed due to high-output failure of an electrical component (op-amp) of the summing circuit.
The root cause of the event was firing circuit design vulnerabilities in the AVR were not identified during the design change due to lack of rigor. Design Changes07-010 and 08-019 assumed full redundancy of the drawer firing circuits. However, the GFMs in the firing circuit were not postulated to fail high and this failure mode was not considered during the design of the AVRs.
4.0 IMMEDIATE CORRECTIVE ACTION(S) The control room operators responded to the event in accordance with emergency procedure 1-E-0, Reactor Trip or Safety Injection. The operators then stabilized the plant using 1-ES-0.1, Reactor Trip Recovery. All safety systems responded appropriately. The unit was stabilized at no-load conditions, the Main Feedwater system was placed in service to all three SGs, and the AFW system was secured and returned to automatic.
5.0 ADDITIONAL CORRECTIVE ACTIONS During the Unit 1 shutdown, two of the GFMs were replaced and the third installed GFM was evaluated to not be required and was disabled.
ODM #352 has been completed to address continued operation with GFM number 3 disabled for the Unit 1 AVR.
The failed number 2 GFM was shipped offsite for failure analysis to determine the reason for the module failure.
6.0 ACTIONS TO PREVENT RECURRENCE The issues associated with Design Changes07-010 and 08-019 for the AVR are considered legacy when compared to the current design change standards and procedures. In 2011, procedure CM-AA-RSK-1001, Engineering Risk Assessment, was revised to conduct third party reviews of contractor-generated design changes to ensure a more rigorous technical and programmatic review of design change documents for high-risk modifications. The standards and expectations implemented during the current design change process identify potential failure mode risks by the failure effects and analysis guidelines described in CM-AA-DDC-201, Design Changes. Procedure revisions also updated the review aspects of the design change process such as including third-party reviews and challenge review milestones. In addition, DNES-AA- GN-1007, Digital Asset Modification Considerations, provides detailed guidance for digital modifications to include detailed procurement specifications, rigorous documentation for Failure Mode Effects and Analysis (FMEA) considerations, and additional oversight to review operating experience and testing results.
Additional corrective actions will be tracked in the Corrective Action Program to completion.
7.0 SIMILAR EVENTS LER N2-2010-001-00 dated June 23, 2010, documents a Unit 2 automatic reactor trip from 74% power while testing a new digital automatic voltage regulator (AVR). A turbine trip due to a generator lockout caused the automatic reactor trip. The root cause of the generator lockout protective relay actuation was determined to be inadequate guidance for software validation for non-safety related equipment that can impact power generation.
8.0 ADDITIONAL INFORMATION North Anna Unit 2 continued operating in Mode 1, 100 percent power during this event.
North Anna Unit 2 has the same GFMs in the AVR firing circuit, but there is no indication that these components have failed high. If one of the three GFMs in the AVR firing circuit failed high, an annunciator in the main control room would alarm.