05000395/LER-2002-004
| Virgil C. Summer Nuclear Station | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation |
| 3952002004R00 - NRC Website | |
PLANT IDENTIFICATION
Westinghouse - Pressurized Water Reactor
EQUIPMENT IDENTIFICATION
(JK) Feedwater Pump Turbine Instrumentation and Control
IDENTIFICATION OF EVENT
On June 17, 2002, with the plant at 100% power, the "C" main feedwater pump tripped as a result of a failed fuse in the feedwater pump digital speed control system. As load was being decreased per procedure and the remaining feedwater pumps speed and discharge flow increased, the operating feedwater pumps' recirculation valves went full open and manual control of the valves was lost in accordance with digital speed control system design logic. With decreased flow available to the steam generators, levels decreased and a reactor trip signal was generated on lo-lo level in the "A" steam generator. This event was documented in Condition Evaluation Report (CER) 02-2036.
EVENT DATE
June 17, 2002
REPORT DATE
August 16, 2002
CONDITIONS PRIOR TO EVENT
Mode 1, 100% power
DESCRIPTION OF EVENT
On June 17, 2002, the "C" main feedwater pump tripped at 1856 hours0.0215 days <br />0.516 hours <br />0.00307 weeks <br />7.06208e-4 months <br />. Upon loss of the pump, the operations crew entered Abnormal Operating Procedure 210.3, "Feedwater Pump Malfunction", and began reducing load accordingly at the rate of 1% per minute. The turbine driven "A" and "B" feedwater pumps began to increase speed and flow to compensate for the feedwater flow load demand resulting from the tripped pump. As the discharge flows from the running pumps increased and over-ranged the flow transmitters, the newly installed digital speed control system interpreted the data as "bad quality".
Per design, each pump's recirculation valve opened and simultaneously removed manual control from the operators. With the recirculation valve open, significant flow was diverted to the deareator and steam generator levels began to decrease. Operations personnel increased the load ramp decrease to 3% per minute, but steam generator levels continued to decrease. "A" steam generator reached a lo-lo level of 30% narrow range initiating a reactor trip signal, and the reactor automatically tripped at 1902 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.23711e-4 months <br />.
CAUSE OF EVENT
The initiating event for the transient was the failure of a fuse in the digital speed control system circuitry of the "C" feedwater pump. The fuse feeds a relay that maintains the SV-12 trip solenoid energized. Upon failure of the fuse, the trip solenoid was de-energized which resulted in a feedwater pump trip. Loss of a feedwater pump at 100% power is covered in the plant's Abnormal Operating Procedures (AOP 210.3) and is addressed by decreasing load and reactor power to between 86% and 91% power.
The cause of the fuse failure was investigated, and while the results were indeterminate, two credible failure mechanisms were identified. These failure mechanisms were a mechanical failure or a true overcurrent condition. A thorough visual inspection of the fuse circuitry identified relay lugs that were not insulated and could potentially come into contact with a metal relay casing and cause an overcurrent condition. A review of industry operating experience also revealed that these fuses had a history of mechanical failure.
While the fuse failure was the initiating event to the transient, the cause of the reactor trip was a design deficiency in the feedwater pump digital speed control system implemented during the last refueling outage (Refuel 13). During the design modification process, the recirculation valve logic was modified to fail open the recirculation valve and lock out manual control of the valve to provide additional pump seal protection in the event of a discharge flow transmitter failure. This logic modification was made without sufficient review and in-depth testing to determine the potential negative consequences that could result.
ANALYSIS OF EVENT
The trip of the "C" feedwater pump was identified upon receipt of the main control board annunciator, " FWP A/B/C TRIP" and operator verification that "C" pump speed was decreasing rapidly and "A" and "B" pumps' speeds were increasing. Actions were immediately taken by operations personnel to decrease load, first using the load limiter and then with the decrease load rate circuit set to 1% per minute. As previously noted the increasing discharge flows of the "A" and "B" feedwater pumps over-ranged the flow transmitters, causing the digital speed control system to interpret the data as "bad quality" and failing open the recirculation valves. The operators tried to take control of the valves both manually and by attempting to switch back to automatic, but were unsuccessful. Steam generator levels, which had recovered slightly, began to decrease rapidly. At the 1% per minute ramp rate the Operations personnel noted that turbine-generator megawatts did not appear to be decreasing at the expected rate and subsequently increased the rate to 3% per minute. Steam generator levels continued to decrease rapidly with the "A" steam generator finally reaching the lo-lo level of 30% narrow range and producing the reactor trip signal. Post trip reviews of the data have shown that the megawatt response was masked in part by the rise in Tave and steam pressure due to the reduction in feedwater flow and the transient conditions in the feedwater heating system.
Subsequent to the reactor trip, the operating crew entered Emergency Operating Procedure (EOP) - 1.0, "Reactor Trip/Safety Injection", and upon determination that Safety Injection was neither initiated or required stabilized the plant under EOP 1.1 "Reactor Trip Recovery". Plant response after the trip was appropriate, with reactor coolant system average temperature, pressurizer pressure and level, and steam generator levels returning to normal, no-load values after the initial trip transient. Reactor coolant system average temperature reached a low of 551.5 degrees F. but returned to no-load value of 557 degrees F. within several minutes as emergency feedwater was throttled. Pressurizer pressure reached an average low value of 1990 psig, but also returned to normal after the initial cooldown.
Pressurizer level reached a low value of 22% and also recovered as expected within minutes. Steam generator pressures experienced the normal post-trip response and increased to no-load of approximately 1090 psig, decreased slowly as full emergency feedwater flow was supplied and the reactor coolant system cooled, and then returned to no-load as emergency feedwater was throttled and the reactor coolant system returned to 557 degrees F. "A" and "C" steam generator narrow range levels did go off scale low, while "B" went to 5% narrow range, but all levels recovered after the trip as both the turbine driven and the 2 motor driven emergency feedwater pumps automatically started upon receipt of the lo-lo steam generator level. All control rods inserted fully and there were no actuations of any primary or secondary side power operated relief valves or safety valves.
. _ a
2. DOCKET
The feedwater pump digital speed control system logic was reviewed in depth. The portion of the original modification package intended to increase the required minimum recirculation flow rate to improve pump stability and protect pump seals was maintained, but was modified to allow for manual control of the recirculation valves for each of the feedwater pumps. Also, "bad quality" data input was revised to provide an alarm function only and not override control functions.
OTHER CORRECTIVE ACTIONS
The failed fuse in the "C" feedwater pump digital speed control system was replaced by a new type fuse along with the corresponding fuses in the "A" and "B" feedwater pumps. The new type fuses have a more reliable industry operating history than the previous type fuse. In addition, specific non-insulated lugs within the digital speed control system circuitry that could have made contact with other components and created a faulted condition were insulated and reconfigured to provide additional protection. The circuits were monitored for 3 weeks during plant startup and power operation to check for spurious overcurrent conditions, however, no unanticipated transients occurred.
PRIOR OCCURRANCES
None