05000390/LER-2001-004, Turbine/Reactor Initiated by an Invalid AMSAC Signal

Turbine/Reactor Initiated by an Invalid AMSAC Signal

ML020530197
Person / Time
Site:	Watts Bar
Issue date:	02/19/2002
From:	Lagergren W Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LER 01-004-00
Download: ML020530197 (11)

LER-2001-004, Turbine/Reactor Initiated by an Invalid AMSAC Signal

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
3902001004R00 - NRC Website

text

Tennessee Valley Authority, Post Office Box 2000, Spring City, Tennessee 37381-2000 William R. Lagergren, Jr.

Site Vice President, Watts Bar Nuclear Plant FEB 19 2002 10 CFR 50.73 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555 Gentlemen:

In the Matter of

)

Docket No. 50-390 Tennessee Valley Authority

)

TENNESSEE VALLEY AUTHORITY - WATTS BAR NUCLEAR PLANT (WBN)

UNIT 1 - DOCKET NO. 50-390 - FACILITY OPERATING LICENSE NPF LICENSEE EVENT REPORT (LER) 50-390/2001-004 The enclosed report provides details of a turbine/reactor trip which occurred on December 19, 2001. This event resulted from an invalid signal initiated by the AMSAC (anticipated transient without scram mitigation system actuation circuitry) system. The plant trip and subsequent actuation of an engineered safety feature is being reported in accordance with 10 CFR 50.73 (a)(2)(iv)(A).

If you should have any questions, please contact P. L. Pace at (423) 365-1824.

Sincerely, W. R.

ergre Enclosure cc: See page 2 Pinted on -e-ycled pap.,

U.S. Nuclear Regulatory Commission Page 2 FEB 19 2002 cc (Enclosure):

NRC Resident Inspector Watts Bar Nuclear Plant 1260 Nuclear Plant Road Spring City, Tennessee 37381 Mr. L. Mark Padovan, Senior Project Manager U.S. Nuclear Regulatory Commission MS 08G9 One White Flint North 11555 Rockville Pike Rockville, Maryland 20852-2738 U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303

Abstract

On December 19, 2001, an invalid AMSAC signal was initiated that resulted in a turbine/reactor trip. The unit was operating at 100% power at the time of the event and work was in process for the placement of a clearance (tagout) to support the implementation of a design change to the control instrumentation for the Turbine Driven Auxiliary Feedwater (TDAFW) pump. The clearance activities opened the breakers which supply power to the instrumentation. The loss of power to the instruments resulted in an invalid steam generator (SG) lo lo level (12%) signal and satisfied the logic (3 out of 4 SGs less than 12% level) for the initiation of an AMSAC signal. All control rods inserted properly and the Auxiliary Feedwater (AFW) system started, as required, in response to the AMSAC signal and the reactor trip. The cause of the event was inadequate interface requirements in the planning and scheduling of trip sensitive activities along with inadequate implementation of the clearance preparation process. The corrective actions included the review of open on-line clearances, development of a standard for the tagging of low voltage equipment, establishment of a formal process which reviews plant work activities for trip sensitive actions, counseling of involved personnel, training on the lessons learned from the event, identification and labeling of trip sensitive breakers, development of an instruction to define the expectations for independent review and to provide controls for the operation and tagging of low voltage breakers.

NRC FORM 366 (7-2)01)U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT TEXT CONTINUATION FACILITY NAME 11)

DOCKET LER NUMBER (6)

PAGE (3) 05000 YEAR SEQUENTIAL REVISION NUMBER 2

1 2 of 9 Watts Bar Nuclear Plant, Unit 1 05000390 2001-004 TEXT (If more space is required, use additional copies of NRC Form 366AI (17)

PLANT CONDITION(S)

The unit was in Mode 1 at 100 % power. Plant operating temperature at the time of the event was 587.3 degrees F with reactor coolant system pressure at 2232 psig.

II.

DESCRIPTION OF EVENT

A.

Event:

On December 19, 2001, at approximately 2319, an invalid AMSAC (anticipated transient without scram mitigation system actuation circuitry) signal was initiated that resulted in a turbine/reactor trip. The unit was operating at 100% power at the time of the event and work was in process for the placement of a clearance (tagout). Once in place the clearance would have supported the implementation of a design change to the control instrumentation for the Turbine Driven Auxiliary Feedwater (TDAFW) pump ((Energy Industry Identification System (EIIS) BA/P. The clearance activities opened the breakers which supply power to the instrumentation. The loss of power to the instruments resulted in an invalid steam generator (SG) lo lo level (12%) signal and satisfied the logic (3 out of 4 SGs less than 12%

level) for the initiation of an AMSAC signal. All control rods inserted properly and the Auxiliary Feedwater (AFW) system started, as required, in response to the AMSAC signal and the reactor trip.

Problem Evaluation Report (PER) 01-017198-000 was initiated to document this event in the TVA Corrective Action Program.

B.

Inoperable Structures, Components, or Systems that Contributed to the Event:

There were no structures, components, or systems inoperable at the start of the event that contributed to the event.U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT TEXT CONTINUATION FACIUTY NAME (1)

DOCKET LER NUMBER (6)

PAGE (3) 05000 YEAR SEQUENTIAL REVISION NUMBER 3 of 9 Watts Bar Nuclear Plant, Unit 1 05000390 2001-004 TEXT [If more space is required, use additional copies of NRC Form 366A) (17)

C.

Dates and Approximate Times of Major Occurrences

l

.December 19, 2001 Time (EST)

Activity 22:12:00 The clearance is issued for manipulation of the breakers 23:17:00 Breaker 39 on 120V AC Vital Power Board 1-IV is opened.

23:19:01 Breaker 39 on 120V AC Vital Power Board 1-Ill opened.

23:19:27 The AMSAC system is actuated and a turbine trip is initiated.

23:19:27 A reactor trip is initiated due to the turbine trip.

23:19:27 The motor driven Auxiliary Feedwater (MDAFW) pumps 1A-A and 1 B-B start.

23:19:55 The generator breaker opens.

D.

Other Systems or Secondary Functions Affected

The implementation of the clearance affected the control instrumentation for the Turbine Driven Auxiliary Feedwater (TDAFW) pump. The Steam Generator (SG) level instrumentation instrument loops for the four SGs are designated as loops 3-172, 3-173, 3-174 and 3-175. The following example is based on loop 3-173 instruments. The operation of the other loops is similar:

When breaker 39 on the 1-IV Vital Power Board (EIIS EF) was opened, power was lost to level modifier (LM) 1-LM-3-173 (EIIS LM). The output of 1-LM-3-173 failed downscale low, and this change in the signal resulted in level switch (LS) 1-LS-3-173E (EIIS LS) sensing that SG level was below the 12% setpoint (operation of the LS in this manner initiates AMSAC).

1-LS-3-173E actuated, closing a contact which energized relay SG2. When 3 out of the 4 level loops actuated in this manner, the associated relay contacts picked up a time delay relay (62A). This relay has a 25 second delay before actuating. Once timed-out, the 62A relay actuated relay RC which tripped the main turbine.

E.

Method of Discovery

The turbine/reactor trip was an automatic response to the invalid AMSAC signal.U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT TEXT CONTINUATION FACILITY NAME 11)

DOCKET LER NUMBER (6)

PAGE (3) 05000 YEAR SEQUENTIAL REVISION I NUM BERI NUMBER 4 of 9 Watts Bar Nuclear Plant, Unit 1 05000390 2001-004

=

TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

F.

Operator Actions

Operations personnel correctly responded to the reactor trip in accordance with Emergency Procedure E-0, "Reactor Trip or Safety Injection." The involved personnel transitioned when required into the appropriate emergency and abnormal procedures to properly stabilize the unit in Mode 3. Members of the operations staff also took measures to assemble a response team to investigate the cause of the plant trip.

G.

Safety System Responses:

The Watts Bar Unit 1 reactor automatically tripped following a turbine trip caused by an invalid AMSAC signal. All control rods inserted properly and the Auxiliary Feedwater (AFW)

System started, as required, in response to the AMSAC signal and the reactor trip. The steam generator levels were at normal prior to the trip. The AFW system was the only engineered safety feature (ESF) equipment required to respond to this event.

Ill.

CAUSE OF THE EVENT

A.

Immediate Cause:

An invalid AMSAC signal initiated the turbine/reactor trip.

B.

Root Cause:

This event was attributed to inadequate interface requirements in the planning and scheduling of trip sensitive activities along with inadequate implementation of the clearance preparation process.

C.

Contributing Factor:

There were no additional contributing factors.

---U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT TEXT CONTINUATION FACILITY NAME (1)

DOCKET LER NUMBER (6)

PAGE (3) 05000 YEAR I SEQUENTIAL I REVISION 5 of 9 Watts Bar Nuclear Plant, Unit 1 05000390 2001-004 TEXT (If more space is required, use additional copies of NRC Form 366A) 117)

IV.

ANALYSIS OF THE EVENT

The assessment of the turbine/reactor trip which occurred on December 19, 2001, established that an invalid AMSAC signal was initiated when a clearance was being placed.

The clearance was initiated to implement a design change to replace four current to current isolators (level modifiers) in the level transmitter instrument loops for the Turbine Driven Auxiliary Feedwater (TDAFW) pump. The replacement of the isolators was necessary because the components are obsolete and can no longer be properly calibrated. Two work orders (WOs) were written to replace the isolators. The two Train A isolators were to be replaced under one work order and the two Train B isolators were to be replaced by the second work order. When the breakers feeding the transmitters were opened a turbine trip was initiated by the AMSAC system which in turn initiated a reactor trip.

The WOs were developed by TVA personnel (Maintenance organization) to implement design change notice (DCN) 50844-A. The DCN was written by TVA personnel (Design Engineering organization) such that it could be implemented in stages to allow for the replacement of a Train of isolators in the event that a single isolator failed. The personnel planning (planner) the WOs, developed the WOs with the assumption that they would be performed independent of each other. There was no information placed into the WOs that documented this assumption. In addition to this, no discussions took place between the WBN Scheduling Work Week Manager (WWM) (Scheduling organization) and the planner regarding the need to implement the WOs at separate times. This resulted in the WWM scheduling the WOs to be worked in parallel during the outage of the TDAFW pump.

Meetings were held and a decision was made to go forward with the pump outage and to arrange the work to minimize the pump outage time. Several iterations of the clearance were developed prior to the final version. During the development process, no version of the clearance identified an interface with the AMSAC system. The preparer and reviewer (TVA - licensed operators) of the clearance worked closely together to develop the different versions of the clearance. The collaboration of these individuals during the development of the clearance lessened the degree of independence under which the documents are normally developed.U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT TEXT CONTINUATION FACIUTY NAME (1)

DOCKET LER NUMBER (6)

PAGE (3) 05000 YEAR SEQUENTIAL REVISION NUMBER 6o I 1 1 6 of 9 Wafts Bar Nuclear Plant, Unit 1 05000390 2001-004 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

IV. There are several other factors which may have impacted the development of the clearance.

One factor was that the clearance was primarily developed from a set of electrical diagrams.

The AMSAC interface with the instrumentation loops was not evident on these drawings as it was on the control and logic diagrams. Further, the WOs included references to the AMSAC system in the precautions and in the work instruction steps which required that AMSAC be placed in block prior to the start of the field work. In addition, the TDAFW pump has been successfully removed from service in the past while the plant was in operation without an AMSAC signal being initiated. However, this was the first outage for the pump that involved all the AMSAC instrument inputs.

Considering the preceding, there appears to have been inadequate interaction among the various personnel/organizations that were working on the TDAFW pump outage.

V.

ASSESSMENT OF SAFETY CONSEQUENCES

The assessment provided in Section 15.2.7, "Loss of External Electrical Load and/or Turbine Trip," captures the December 19, 2001, trip. This trip was less challenging than the event addressed in the FSAR. This conclusion is based on the following plant conditions which are bounded by the event described in the FSAR:

1.

Reactor power was equal to or less than the analyzed value used in the FSAR.

2.

Reactor control was in automatic versus manual as described in the FSAR.

3.

The condenser steam dump valves operated as designed. The FSAR does not take credit for their use.

In summary, the reactor trip was automatic in response to a turbine trip generated from an AMSAC signal. The turbine trip resulted by design, in a reactor trip since reactor power was greater than 50% power. The plant response remained within the FSAR bounding analysis. The pressurizer power operated relief valves and safeties were not required to limit Reactor Coolant System (RCS, EIIS AB) pressure. Similarly, the condenser steam dump valves and the Auxiliary Feedwater (AFW) system operated as required so that operation of the steam generator power operated relief valves and the steam generator safety valves was not required. RCS pressure and loop average temperatures decreased during the transient rather than increasing as predicted by conservative FSAR assumptions. These differences between the FSAR and the plant event are associated with the conservatism of the FSAR analysis and the actual plant event which was quickly brought to a stable condition.

NRC FORM 365A U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT TEXT CONTINUATION FACILITY NAME (1)

DOCKET LER NUMBER (6)

PAGE (3) 05000 YEAR SEQUENTIAL REVISION NUMBER 7 of 9 Watts Bar Nuclear Plant, Unit 1 05000390 2001-004 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

V. The December 1 th event resulted from an AMSAC actuation due to the generation of a steam generator (SG) lo lo level (12%) signal. The loss of inventory in the SGs is addressed in Section 15.2.8, "Loss of Normal Feedwater," of the FSAR. Since it has been established that the lo lo level signal was invalid, the loss of normal feedwater transient was not considered applicable to the December 1 gth event.

Further, there were no safety implications to the public related to the event. The only engineered safety feature (ESF) equipment actuation was an AFW start in response to the AMSAC signal. All plant equipment responded within the design basis, and there were no abnormal radiological conditions during the event.

VI.

CORRECTIVE ACTIONS

A.

Immediate Corrective Actions

Operations personnel correctly responded to the reactor trip in accordance with Emergency Procedure E-0, "Reactor Trip or Safety Injection." The involved personnel transitioned when required into the appropriate emergency and abnormal procedures to properly stabilize the unit in Mode 3. Members of the operations staff also took measures to assemble a response team to investigate the cause of the plant trip.

B.

Corrective Actions to Prevent Recurrence:

The following actions are tracked under TVA's corrective action program and therefore, are not considered to be regulatory commitments:

1.

A review of open on-line clearances was performed.

2.

Development of a standard for the tagging of low voltage equipment.

3.

Establishment of a formal process which reviews plant work activities for trip sensitive actions. The process will include; 1) identification of trip sensitive actions,

2) outage to on-line activities, 3) defeat/bypass of Technical Specification and Non-Technical Specification protection systems/circuits, 4) the review of online DCNs, and 5) the expectation that there be participation of Planning, Scheduling, System Engineering and Operations including the clearance writers.

NRC FORM 306A U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT TEXT CONTINUATION FACILITY NAME 11)

DOCKET LER NUMBER (6)

PAGE 13) 05000 YEAR SEQUENTIAL REVISION NUMBER 1 8 of 9 Watts Bar Nuclear Plant, Unit 1 05000390 2001-004 o

TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

VI. 4.

The System Engineering Manager and Senior Reactor Operator involved in this event have been counseled.

5.

The lessons learned associated with this event have been discussed with the system engineering, the work week managers, and the planners and schedulers.

6.

The details of this event will be developed into a training module for use in licensed operator requalification training, in non-license operator training and in the training provided to personnel involved in the clearance process.

7.

The low voltage breakers that may directly trip the turbine or reactor will be identified and labeled. The breakers will also be added to a database to assist operations personnel in the identification of the breakers.

8.

Develop an instruction that, 1) provides expectations for independence of review and preparation in the hold order process, 2) provides specific controls for operation and tagging of low voltage breakers, and 3) provides management expectations for document (WO, DCN, etc) reviews.

9.

Instructions will be added to the planners guide and the design change process related to requirements for the flagging of sensitive activities.

10.

The AMSAC level transmitters will be assigned to the appropriate functional equipment group.

11.

A clearance request form will be added to SPP-10.2, "Clearance Program."

Vill.

ADDITIONAL INFORMATION

A.

Failed Components:

This event did not involve a failed component.U.S. NUCLEAR REGULATORY COMMISSION LICENSEE. EVENT REPORT TEXT CONTINUATION FACILITY NAME (1I DOCKET LER NUMBER (6)

PAGE (3) 05000 YEAR SEQUENTIAL I REVISION NUMBER 9

9 of 9 Watts Bar Nuclear Plant, Unit 1 05000390 2001-004 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

VIL. B.

Previous LERs on Similar Events:

WBN has experienced two previous events related to AMSAC actuation. These events occurred on March 18, 1996, and April 16, 1996. The cause of both events was determined to be the invalid actuation of the valve (FSV-047-0026B) which relieves electrohydraulic control (EHC) fluid from the turbine governor valve emergency fluid header.

The actuation of the valve was caused by an invalid signal from the AMSAC system generated by an automatic self-check feature of the system which occurs every 13 days and 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Since that time, the original AMSAC system has been replaced by a new system which does not include the automatic self-check feature. The December 1 9th event resulted from an AMSAC actuation due to an invalid steam generator (SG) lo lo level (12%) signal.

Therefore, the cause of the March 1 8, 1996, and April 16, 1996, events is not relevant to the event discussed in this report.

C.

Additional Information

None D.

Safety System Functional Failure Consideration:

This event did not result in a safety system functional failure in accordance with NEI 99-02, Section 2.2.

E.

Loss of Normal Heat Removal Consideration:

The plant trip discussed in this report does not represent a scram with loss of normal heat removal event.

Vill.

COMMITMENTS

None.