05000397/LER-2006-001
| Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No 0500 | |
| Event date: | 10-31-2006 |
|---|---|
| Report date: | 01-02-2007 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| Initial Reporting | |
| ENS 42950 | 10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation |
| 3972006001R00 - NRC Website | |
Plant Condition The plant was operating in Mode 1 at 100 percent power at the time of this event.
Event Description
On October 31, 2006 at 0445 hours0.00515 days <br />0.124 hours <br />7.357804e-4 weeks <br />1.693225e-4 months <br />, the reactor [RCT] tripped from 100% power. The trip resulted from a Reactor Protection System (RPS) [JC] actuation due to a failure in the Digital Electro-Hydraulic (DEH) system used to position Main Turbine [TA] valves. The failure caused four turbine throttle valves (TVs) [FCV] and four turbine governor valves (GVs) [FCV] to spuriously stroke to the full close position. When the TVs were closing and reached a position less than 95% open, RPS logic was met and a Reactor Scram occurred. The RPS actuates to generate a scram when three or more TVs are less than or equal to 95% open with reactor power greater than or equal to 30%.
All rods fully inserted as expected in response to the RPS actuation. No safety or relief valves lifted during the transient. Reactor water level 3 isolation occurred with the minimum level attained being minus 6 inches as indicated on control room recorders. Post trip reactor vessel water level was maintained by normal feedwater.
There was no inoperable equipment at the start of the event that contributed to the event.
At 0704 hours0.00815 days <br />0.196 hours <br />0.00116 weeks <br />2.67872e-4 months <br />, the NRC was notified of the RPS actuation per 10 CFR 50.72(b)(2)(iv)(B) (reference event notification 42950). This LER is submitted pursuant to 50.73(a)(2)(iv)(A) as an event or condition that resulted in manual or automatic actuation of the reactor protection system.
Immediate Corrective Action Following the event, a Technical Issues Resolution (TIR) team was formed to investigate the inadvertent valve closure. Plant staff performed numerous troubleshooting activities. This work determined the cause of the failure was a fault in the output driver circuit of a NUCANA Digital Input (NDI) card [ECBD] associated with the Autostop Oil Pressure Trip Switch circuit. The card was replaced and the circuit successfully tested.
Remaining NDI cards were tested to determine if additional problems exist and no defects were noted. This is the first occurrence of an NDI card failure at Columbia Generating Station.
Cause
The root cause of this event is the DEH Control System design has single point vulnerabilities with logic cards that do not exhibit a predictable failure mechanism which would allow replacement prior to failure.
The logic card failure was due to a failure of an output peripheral driver chip on a DEH Digital Input Card associated with the Autostop Oil Pressure Trip Switch circuit. When the chip failed, the output went to high voltage which is equivalent to a turbine unlatched condition. This false turbine unlatched condition is the initiator for the subsequent turbine valve motion.
26158 R3 Normally, output signals from DEH are used to position Main Turbine Governor Valves, Throttle Valves, and Main Steam Bypass valves. During 100% power operation, DEH is operating to control reactor pressure by monitoring steam header pressure and modulating the position of the turbine governor valves. Under this condition the turbine throttle valves are in a full open position and the steam bypass valves are shut.
DEH receives an input when the turbine is latched to change control modes and control sources. The source of this input is Turbine Oil (TO) [TD] Auto Stop Header pressure. The Auto Stop Header is pressurized by turbine oil to apply pressure to the Interface Diaphragm valve which results in its closure. Closure of this valve allows porting of high pressure hydraulic oil to the turbine valves when the turbine is latched. The Auto Stop Header is depressurized as a result of various turbine trip signals. Low pressure in the Auto Stop Header is used as an indication of a Turbine Trip signal by DEH.
Further Corrective Action The DEH system has been previously determined to have multiple single point vulnerabilities. Long-term corrective actions have been pursued such that a new DEH system is scheduled to be installed in refueling outage R18 (May/June 2007).
Assessment of Safety Consequences
For this event, both trains of emergency AC power [EA, EB & EK], High-Pressure Core Spray (HPCS) [BG], Reactor Core Isolation Cooling (RCIC) [BN], and Residual Heat Removal (RHR) [BO] were capable of performing their intended safety function. This event did not involve an event or condition that alone could have prevented the fulfillment of any safety function described in 10 CFR 50.73(a)(2)(v). This event posed no threat to the health and safety of the public or plant personnel and was therefore, not safety significant.
Similar Events The relevant recent LERs and Problem Evaluation Reports (PERs) for DEH Control System circuit card failures include: LERs 2004-004 (PER 204-0972) and 2005-003 (PER 205-0424).
This is the third reactor scram with DEH card failure as the cause since 2004. Each of these failures is associated with a different type of DEH card. The specific failure for each card is varied and there is no discernible trend in individual component failures. Internal experience shows these failures are random and the elimination of these failures would require DEH system replacement.
EIIS information denoted as [XX1 26158 R3