05000354/LER-2009-001
| Docket Number Sequential Revmonth Day Year Year Month Day Year N/Anumber No. | |
| Event date: | |
|---|---|
| Report date: | |
| Initial Reporting | |
| 3542009001R00 - NRC Website | |
PLANT AND SYSTEM IDENTIFICATION
General Electric — Boiling Water Reactor (BWR/4) Safety and Turbine Auxiliaries Cooling System (STACS) *Energy Industry Identification System {EIIS} codes and component function identifier codes appear as {SS/CCC}
IDENTIFICATION OF OCCURRENCE
Event Date/Time: January 17, 2009 / 0432 Discovery Date/Time: January 17, 2009 / 0432
CONDITIONS PRIOR TO OCCURRENCE
Hope Creek was in Operational Condition 1 with reactor power at 100%. No structures, systems, or components were inoperable that contributed to the event.
DESCRIPTION OF OCCURRENCE
The Safety and Turbine Auxiliaries Cooling System (STACS) {BI*, KG*} is a closed loop cooling water system consisting of two subsystems: a Safety Auxiliaries Cooling System (SACS) {B1*} and a Turbine Auxiliaries Cooling System (TACS) {KG*}.
The SACS, which has a safety-related function, is designed to provide cooling water to the engineered safety features (ESF) equipment, including the residual heat removal (RHR) heat exchangers, during normal operation, normal plant shutdown, loss of offsite power (LOP), and a loss-of-coolant accident (LOCA). There are two SACS subsystems, with two pumps per loop that supply SACS loads. One of these subsystems is also aligned (via supply and return isolation valves) to provide cooling water to the TACS system loads.
The TACS, which has no safety-related function, is designed to provide cooling water to the turbine auxiliary equipment during normal plant operation and normal plant shutdown.
Normal system configuration is one SACS subsystem (A or B) supplying its own SACS loads and all of the TACS loads via two supply (HV-2522's) and two return (HV-2496's) isolation valves. The other SACS subsystem supplies its own SACS loads and is the backup TACS cooling water supply. If a low flow condition is sensed in the TACS system, the isolation valves in the backup SACS subsystem automatically open, and the second pump in the backup SACS subsystem starts, to supply the cooling to the TACS loads. The SACS/TACS supply and return isolation valves for the original SACS subsystem are closed by operator action in response to the transient. Until the SACS/TACS isolation valves are closed for the original SACS subsystem, water will transfer from the SACS subsystem supplying the TACS loads to the other SACS subsystem causing a lowering head tank level in the SACS subsystem supplying the TACS loads. Upon receipt of a LO-LO-LO head tank level in the SACS subsystem supplying the TACS loads, all of the supply and return SACS/TACS isolation valves in the SACS subsystem supplying the TACS loads are automatically closed. This ensures cooling to the safety related SACS loads.
� On January 17th 2009 at 0432, Hope Creek station was manually scrammed by the mode switch being locked in the SHUTDOWN position. The core thermal power (CTP) was approximately 73% of rated and the scram was caused by the enforcement of a neutron monitoring system scram setpoint (APRM HI-HI > 14% of rated CTP) with the mode switch not in RUN.
At 0425 the TACS was being supplied by the A SACS system. TACS automatically initiated a swap from the A SACS subsystem to the B SACS subsystem due to a failure of the TACS supply valve (EG-HV 2522C). This is one of two valves in the A SACS subsystem that supplies water to the TACS system when the A SACS subsystem is in-service. The closure of the EG-HV-2522C caused a low pressure condition in the TACS system so the system automatic response was to align the B SACS subsystem to supply TACS loads.
During the transfer to the B SACS subsystem, the associated return isolation valves to the A SACS subsystem (EG-HV-2496A and -2496C) remained open which allowed water returning from the TACS system to the SACS systems to flow to the A SACS head tank. This caused an inventory transfer from the B SACS subsystem to the A SACS subsystem and resulted in a LO-LO-LO head tank level in the B SACS subsystem.
The LO-LO-LO level in the B SACS head tank caused an automatic closure of all SACS/TACS supply and return isolation valves in the B SACS subsystem. This is an automatic function to maintain cooling to the SACS loads in the event of a TACS pipe rupture. The control room operators then attempted to re-establish cooling to the TACS system using the A SACS subsystem; however the EG-HV-2522C valve did not open, resulting in a total loss of cooling to the TACS system.
The system automatic response to a high stator water cooling (SWC) {TJ*} temperature is to initiate a turbine runback, and a recirculation pump runback so that the CTP remains within the capacity of the generator and the turbine bypass valve system. The abnormal procedure (HC.OP-AB.COOL-0002) requires that the operator lock the mode switch in the SHUTDOWN position if there is a sustained loss of the TACS.
During the transient, the operator at the controls noted that a sustained loss had occurred and locked the mode switch in the SHUTDOWN position. This caused the expected automatic neutron monitoring trip actuation of the reactor protection system (RPS) which generated the scram signal.
Following the reactor scram, it was observed that two control rods on or near the core periphery failed to promptly settle back to "00" from the "full-in" position. Potential channel distortion was determined to be the most likely cause and was validated during shutdown control rod exercising. The two control rod locations were not identified as locations that would require channel distortion surveillance testing by the cell friction models. However, the locations were in the predicted population that may exhibit a low frequency of "no settle" conditions. The two control rods were declared inoperable pending Channel Distortion Testing and were inserted to 00 for the startup. Subsequently, Channel Distortion Testing was performed on these two rods and three other operationally symmetric rods using the guidance in Safety Communication (SC) 08-05 Revision 1. The two original rods were determined to be operable by meeting the criteria described in the SC, returned to service, and withdrawn to their desired position of "48" (fully withdrawn).
_ Following the scram, the reactor pressure vessel (RPV) water level was controlled using the normal feed and condensate systems.
All other safety systems functioned as designed.
SAFETY CONSEQUENCES
The safety consequences of this event were minimal. This event resulted in no nuclear, radiological, or industrial safety consequences. No Emergency Core Cooling System (ECCS) actuations occurred.
A review of this event determined that a Safety System Functional Failure (SSFF) did not occur as defined in Nuclear Energy Institute (NEI) 99-02.
CAUSE OF OCCURRENCE
A root cause evaluation of the event was conducted and concluded that the root cause of the scram was the STACS design does not provide for sufficient operational margin to prevent the transfer of water from one SACS subsystem to the other during a low flow transfer of TACS loads. This lack of margin resulted in a LO-LO-LO head tank level in the subsystem that automatically began supplying the TACS loads within approximately 40 seconds after the swap. This LO-LO-LO level caused isolation of the TACS loads and necessitated the operator inserting a reactor scram signal.
Contributing causes identified were:
(1) The EG-HV-2522 C valve failed closed after a week of operation, resulting in the loss of cooling to the TACS loads. The actuator of the valve had a failed solenoid {SOL/FSV*} that prevented the HV-2522 C from opening. The solenoid was determined to have a lead wire detachment and had been in service for approximately one week prior to the failure.
(2) Ineffective corrective actions from similar events (in 1994 and 2006). A design change package (DCP) was identified in 1994 as a corrective action to a similar event. The DCP was canceled and no follow-up actions were taken to ensure the completion of the corrective actions from the original evaluation. The 2006 event corrective actions focused only on the specific failure (Bailey Card) and not on the challenge presented by the transfer of water from one SACS subsystem to the other during loop swap.
(3) The indication in the control room for the TACS isolation valves is misleading in that one set of lights (red/green) is used for both valves (both supply and return isolation valves for one channel use one common light) and that the red (open) light remains lit for all conditions except when both valves are fully closed and the green (closed) light remains lit for all conditions except when both valves are fully open.
�
PREVIOUS OCCURRENCES
On August 30, 1994, a high RPV pressure signal caused a reactor scram. The scram followed a turbine runback and reactor recirculation pump runback initiated by high stator water temperature on the main generator. The high stator water temperature was a result of loss of the TACS cooling water. The loss of TACS cooling water was a result of an unsuccessful swap-over of SACS loops. A blown fuse initiated the event by closing an isolation valve in the SACS/TACS loop.
On August 7, 1997, operators swapped the TACS loads from the A SACS subsystem to the B SACS subsystem. The C SACS pump automatically started in response to a low flow signal to TACS. The low flow signal was caused by the closure of the B SACS/TACS supply isolation valve. The TACS loads automatically transferred back to the A SACS subsystem. On September 4, 1997, the B SACS/TACS supply and return isolation valves automatically closed in response to a spurious LO-LO-LO expansion tank level in the B SACS subsystem. Coincident with this, a LO-LO fuel pool skimmer surge tank level was received.
The cause of these events was determined to be a loose fuse clip in the 1 E analog cabinet that provides inputs to the digital logic control system. The loose fuse clip caused intermittent spurious signals. The fuse clip was replaced.
On December 31, 2006, a Bailey control card problem resulted in the closure of the TACS supply isolation valve on the loop supplying cooling flow to TACS. Before the transfer was manually completed by closing the suction isolation valves on the affected loop, the in-service head tank received a LO-LO-LO signal and isolated the TACS cooling water. The system attempted to swap back to the previous loop and the valve failed closed again. The operators took manual control and were able to reestablish TACS cooling water flow before other actions were required.
CORRECTIVE ACTIONS
1. The B SACS loop was manually aligned to provide cooling to the TACS loads upon restoration of the B SACS expansion tank level.
2. The cause of the failure of the EG-HV-2522C valve was investigated and it was determined that a solenoid valve in the actuator was found failed, preventing the valve from opening. The solenoid in the actuator was replaced, the valve tested and returned to service.
3. The operating procedure (HC.OP-AB.ZZ-0001) has been revised to initiate closure of the low flow loop SACS/TACS isolation valves immediately upon recognition that a low flow condition exists to mitigate the transfer of water between the SACS subsystems during the loop swap.
4. The logic for the low flow loop transfer is being reviewed for a design change to address the transfer of water between SACS subsystems during a loop swap.
CORRECTIVE ACTIONS (continued):
5. The human factors issue associated with the SACS/TACS isolation valve position indication in the control room is being evaluated for enhancements to the Control Room Information Display System (CRIDS) project.
COMMITMENTS
This LER contains no commitments.