05000390/LER-2001-004
| Watts Bar Nuclear Plant | |
| Event date: | 12-19-2001 |
|---|---|
| Report date: | 02-19-2002 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 3902001004R00 - NRC Website | |
FACILITY NAME 11)
- DOCKET LER NUMBER (6) PAGE (3) 05000 2001-004
I. PLANT CONDITION(S)
The unit was in Mode 1 at 100 % power.
the event was 587.3 degrees F with reactor
II. DESCRIPTION OF EVENT
A. Event:
Plant operating temperature at the time coolant system pressure at 2232 psig.
2319, an invalid AMSAC (anticipated transient circuitry) signal was initiated that resulted at 100% power at the time of the event and a clearance (tagout). � Once in place the clearance of a design change to the control instrumentation (TDAFW) pump ((Energy Industry Identification opened the breakers which supply power the instruments resulted in an invalid steam satisfied the logic (3 out of 4 SGs less than All control rods inserted properly and the as required, in response to the AMSAC signal was initiated to document this event Systems that Contributed to the Event:
of in a to 12% , On December 19, 2001, at approximately without scram mitigation system actuation turbine/reactor trip.
� The unit was operating work was in process for the placement of would have supported the implementation for the Turbine Driven Auxiliary Feedwater System (EIIS) BA/P. � The clearance activities the instrumentation. The loss of power to generator (SG) lo lo level (12%) signal and level) for the initiation of an AMSAC signal.
Auxiliary Feedwater (AFW) system started, and the reactor trip.
Problem Evaluation Report (PER) 01-017198-000 in the TVA Corrective Action Program.
B. Inoperable Structures, Components, or There were no structures, components, or systems inoperable at the start of the event that contributed to the event.
05000 C. Dates and Approximate Times of Major Occurrences:
December 19, 2001 Time (EST) Activity 22:12:00 The clearance is issued for manipulation of the breakers 23:17:00 Breaker 39 on 120V AC Vital Power Board 1-IV is opened.
23:19:01 Breaker 39 on 120V AC Vital Power Board 1-Ill opened.
23:19:27 The AMSAC system is actuated and a turbine trip is initiated.
23:19:27 A reactor trip is initiated due to the turbine trip.
23:19:27 The motor driven Auxiliary Feedwater (MDAFW) pumps 1A-A and 1 B-B start.
23:19:55 The generator breaker opens.
D. Other Systems or Secondary Functions Affected:
The implementation of the clearance affected the control instrumentation for the Turbine Driven Auxiliary Feedwater (TDAFW) pump. The Steam Generator (SG) level instrumentation instrument loops for the four SGs are designated as loops 3-172, 3-173, 3- 174 and 3-175. The following example is based on loop 3-173 instruments. The operation of the other loops is similar:
When breaker 39 on the 1-IV Vital Power Board (EllS EF) was opened, power was lost to level modifier (LM) 1-LM-3-173 (EllS LM). The output of 1-LM-3-173 failed downscale low, and this change in the signal resulted in level switch (LS) 1-LS-3-173E (EllS LS) sensing that SG level was below the 12% setpoint (operation of the LS in this manner initiates AMSAC). 1-LS-3-173E actuated, closing a contact which energized relay SG2. When 3 out of the 4 level loops actuated in this manner, the associated relay contacts picked up a time delay relay (62A). This relay has a 25 second delay before actuating. Once timed-out, the 62A relay actuated relay RC which tripped the main turbine.
E. Method of Discovery:
The turbine/reactor trip was an automatic response to the invalid AMSAC signal.
FACILITY NAME 11) DOCKET LER NUMBER (6) PAGE (3) 05000 2001-004
F. Operator Actions:
to the reactor trip in accordance with or Safety Injection." � The involved personnel emergency and abnormal procedures to Members of the operations staff also took to investigate the cause of the plant trip.
tripped following a turbine trip caused by an properly and the Auxiliary Feedwater (AFW) to the AMSAC signal and the reactor trip. The to the trip. The AFW system was the only required to respond to this event.
trip.
requirements in the planning and with inadequate implementation of the clearance Operations personnel correctly responded Emergency Procedure E-0, "Reactor Trip transitioned when required into the appropriate properly stabilize the unit in Mode 3.
measures to assemble a response team
G. Safety System Responses:
The Watts Bar Unit 1 reactor automatically invalid AMSAC signal. � All control rods inserted System started, as required, in response steam generator levels were at normal prior engineered safety feature (ESF) equipment III. � CAUSE OF THE EVENT
A. Immediate Cause:
An invalid AMSAC signal initiated the turbine/reactor
B. Root Cause:
This event was attributed to inadequate interface scheduling of trip sensitive activities along preparation process.
C. Contributing Factor:
There were no additional contributing factors.
FACILITY NAME 11) DOCKET LER NUMBER (6) PAGE (3) 05000 2001-004 IV. A ANALYSIS OF THE EVENT The assessment of the turbine/reactor trip which occurred on December 19, 2001, established that an invalid AMSAC signal was initiated when a clearance was being placed.
The clearance was initiated to implement a design change to replace four current to current isolators (level modifiers) in the level transmitter instrument loops for the Turbine Driven Auxiliary Feedwater (TDAFW) pump. The replacement of the isolators was necessary because the components are obsolete and can no longer be properly calibrated. Two work orders (WOs) were written to replace the isolators. The two Train A isolators were to be replaced under one work order and the two Train B isolators were to be replaced by the second work order. When the breakers feeding the transmitters were opened a turbine trip was initiated by the AMSAC system which in turn initiated a reactor trip.
The WOs were developed by TVA personnel (Maintenance organization) to implement design change notice (DCN) 50844-A. The DCN was written by TVA personnel (Design Engineering organization) such that it could be implemented in stages to allow for the replacement of a Train of isolators in the event that a single isolator failed. D The personnel planning (planner) the WOs, developed the WOs with the assumption that they would be performed independent of each other. There was no information placed into the WOs that documented this assumption.
D In addition to this, no discussions took place between the WBN Scheduling Work Week Manager (WWM) (Scheduling organization) and the planner regarding the need to implement the WOs at separate times. This resulted in the WWM scheduling the WOs to be worked in parallel during the outage of the TDAFW pump.
Meetings were held and a decision was made to go forward with the pump outage and to arrange the work to minimize the pump outage time. D Several iterations of the clearance were developed prior to the final version. D During the development process, no version of the clearance identified an interface with the AMSAC system. The preparer and reviewer (TVA - licensed operators) of the clearance worked closely together to develop the different versions of the clearance. The collaboration of these individuals during the development of the clearance lessened the degree of independence under which the documents are normally developed.
FACILITY NAME (1) DOCKET LER NUMBER (6) PAGE (3) 05000 2001-004 IV. ANALYSIS OF THE EVENT (continued) There are several other factors which may have impacted the development of the clearance.
One factor was that the clearance was primarily developed from a set of electrical diagrams.
The AMSAC interface with the instrumentation loops was not evident on these drawings as it was on the control and logic diagrams.
� Further, the WOs included references to the AMSAC system in the precautions and in the work instruction steps which required that AMSAC be placed in block prior to the start of the field work. � In addition, the TDAFW pump has been successfully removed from service in the past while the plant was in operation without an AMSAC signal being initiated. � However, this was the first outage for the pump that involved all the AMSAC instrument inputs.
Considering the preceding, there appears to have been inadequate interaction among the various personnel/organizations that were working on the TDAFW pump outage.
V. ASSESSMENT OF SAFETY CONSEQUENCES
The assessment provided in Section 15.2.7, "Loss of External Electrical Load and/or Turbine Trip," captures the December 19, 2001, trip. � This trip was less challenging than the event addressed in the FSAR. This conclusion is based on the following plant conditions which are bounded by the event described in the FSAR:
1. Reactor power was equal to or less than the analyzed value used in the FSAR.
2. Reactor control was in automatic versus manual as described in the FSAR.
3. The condenser steam dump valves operated as designed. The FSAR does not take credit for their use.
In summary, the reactor trip was automatic in response to a turbine trip generated from an AMSAC signal. The turbine trip resulted by design, in a reactor trip since reactor power was greater than 50% power. The plant response remained within the FSAR bounding analysis. The pressurizer power operated relief valves and safeties were not required to limit Reactor Coolant System (RCS, EllS AB) pressure. Similarly, the condenser steam dump valves and the Auxiliary Feedwater (AFW) system operated as required so that operation of the steam generator power operated relief valves and the steam generator safety valves was not required.
� RCS pressure and loop average temperatures decreased during the transient rather than increasing as predicted by conservative FSAR assumptions. These differences between the FSAR and the plant event are associated with the conservatism of the FSAR analysis and the actual plant event which was quickly brought to a stable condition.
FACILITY NAME (1) DOCKET LER NUMBER (6) PAGE (3) 05000 2001-004
V. ASSESSMENT OF SAFETY CONSEQUENCES
The December 19th event resulted from an steam generator (SG) lo lo level (12%) signal.
in Section 15.2.8, "Loss of Normal Feedwater," that the lo lo level signal was invalid, the considered applicable to the December 19 h` Further, there were no safety implications engineered safety feature (ESF) equipment AMSAC signal. All plant equipment responded abnormal radiological conditions during the
VI. CORRECTIVE ACTIONS
A. Immediate Corrective Actions:
(continued) AMSAC actuation The loss of the loss of normal event.
to the public actuation was within the event.
to the reactor or Safety Injection.
of the to investigate emergency due to the generation of a of inventory in the SGs is addressed FSAR. � Since it has been established feedwater transient was not related to the event. � The only an AFW start in response to the design basis, and there were no trip in accordance with The involved personnel and abnormal procedures to operations staff also took the cause of the plant trip.
action program and therefore, voltage equipment.
plant work activities for trip of trip sensitive actions, of Technical Specification and Non- 4) the review of online DCNs, of Planning, Scheduling, System writers.
Operations personnel correctly responded Emergency Procedure E-0, "Reactor Trip transitioned when required into the appropriate properly stabilize the unit in Mode 3. � Members measures to assemble a response team
B. Corrective Actions to Prevent Recurrence:
The following actions are tracked under TVA's corrective are not considered to be regulatory commitments:
1. A review of open on-line clearances was performed.
2. Development of a standard for the tagging of low 3. Establishment of a formal process which reviews sensitive actions. � The � process will include; 1) identification 2) outage to on-line activities, � 3) defeat/bypass Technical Specification protection systems/circuits, and 5) the expectation that there be participation Engineering and Operations including the clearance FACILITY NAME 11) DOCKET LER NUMBER (6) PAGE (3) 05000 2001-004 VI. � CORRECTIVE ACTIONS (continued) 4. The System Engineering Manager have been counseled.
5. The lessons learned associated with engineering, the work week managers, 6. The details of this event will be developed operator requalification training, in provided to personnel involved in 7. The low voltage breakers that may identified and labeled. � The breakers operations personnel in the identification 8. Develop an instruction that, 1) provides and preparation in the hold order and tagging of low voltage breakers, document (WO, DCN, etc) reviews.
9. Instructions will be added to the related to requirements for the flagging 10. The AMSAC level transmitters equipment group.
11. A clearance request form will be VII. � ADDITIONAL INFORMATION A. � Failed Components:
and Senior Reactor Operator involved in this event this event have been discussed with the system and the planners and schedulers.
into a training module for use in licensed non-license operator training � and in the training the clearance process.
directly trip the turbine or reactor will be will also be added to a database to assist of the breakers.
expectations for independence of review process, � 2) provides specific controls for operation and 3) provides management expectations for planners guide and the design change process of sensitive activities.
will be assigned to the appropriate functional added to SPP-10.2, "Clearance Program.
This event did not involve a failed component.
FACILITY NAME (1) DOCKET LER NUMBER (6) PAGE (3) 05000 2001-004 VII. � ADDITIONAL INFORMATION (continued) B. Previous LERs on Similar Events:
related to AMSAC 16, 1996. The the valve (FSV-047-0026B) the turbine governor an invalid signal of the system system feature.
steam generator and April actuation. These events cause of both events was which relieves valve emergency fluid header.
from the AMSAC system which occurs every 13 days and has been replaced by a new system The December 19th event resulted (SG) lo lo level (12%) signal.
16, 1996, events is not relevant to failure in accordance with a scram with loss of normal WBN has experienced two previous events occurred on March 18, 1996, and April determined to be the invalid actuation of electrohydraulic control (EHC) fluid from The actuation of the valve was caused by generated by an automatic self-check feature 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. � Since that time, the original AMSAC which does not include the automatic self-check from an AMSAC actuation due to an invalid Therefore, the cause of the March 18, 1996, the event discussed in this report.
C. Additional Information:
None
D. Safety System Functional Failure Consideration:
This event did not result in a safety system functional NEI 99-02, Section 2.2.
E. Loss of Normal Heat Removal Consideration:
The plant trip discussed in this report does not represent heat removal event.
VIII. � COMMITMENTS None.