05000400/LER-2003-001
| Harris Nuclear Plant - Unit 1 | |
| Event date: | 05-18-2003 |
|---|---|
| Report date: | 07-17-2003 |
| Initial Reporting | |
| 4002003001R00 - NRC Website | |
I. DESCRIPTION OF EVENT
On May 18, 2003 at 1807 with the reactor at approximately 27% power following a refueling outage (RFO-11), the reactor was automatically tripped from a turbine trip-reactor trip signal. Plant equipment functioned as required. The operations staff responded to the event in accordance with applicable plant procedures. The plant stabilized at normal operating no-load reactor coolant system (RCS) [AB] temperature and pressure following the reactor trip.
Both electrical and mechanical failure modes were analyzed to determine the cause of the turbine trip-reactor trip signal for this event. Specifically, 15 potential electrical failure modes and 14 potential mechanical failure modes were analyzed. The analysis concluded that only the following two electrical failure modes remained as possible failure modes: (1) a turbine overspeed sensing probe [SIT] failure that resulted in generation of a spurious turbine overspeed signal or (2) an electrical overspeed circuit fault in the emergency trip cabinet [CAB].
The most likely failure mode is an electrical failure of the turbine overspeed sensing probe that resulted in generation of a spurious turbine overspeed signal. This spurious signal subsequently resulted in the reactor trip.
The sensing probe that was in service at the time of the trip remains installed in the system and is unavailable for forensic analysis until the next refueling outage (RFO-12). The forensic analysis should provide the specific failure mechanism for the turbine overspeed sensing probe failure.
The other possible failure mode is an electrical overspeed circuit fault in the emergency trip cabinet. Specifically, other plants have experienced a phenomena associated with the vintage of the speed comparator card [ECBD] where the power supply on the card adversely impacts (through generation of radio frequency or heat) the output of the amplifier [AMP] components. A fault in the output of the amplifier components could subsequently cause a reactor trip. The vintage of the installed speed comparator card is unknown at this time and will be verified no later than the next refueling outage (RFO-12). The verification of the speed comparator card will determine if the card is susceptible to this phenomenon.
Energy Industry Identification System (EIIS) codes are identified in the text within brackets [ ].
II. CAUSE OF EVENT
The root cause is a design vulnerability in which a single component failure can result in a spurious turbine overspeed signal and subsequently cause a reactor trip.
III. SAFETY SIGNIFICANCE
Actual Safety Consequences:
Other than the transient induced by the automatic reactor trip, no safety significant consequences exist as a result of this event. The plant tripped from approximately 27% power. This trip was initiated by a turbine trip signal to the Reactor Protection System, which subsequently tripped the reactor. Turbine trips that result in reactor trips are analyzed for the Harris Nuclear Plant (HNP) and are classified as an ANS Condition II event — a fault of moderate frequency.
The plant is designed for a turbine trip-reactor trip, and it responded as expected for this condition. The initial plant conditions were within the bounding conditions for the plant design. The plant was stabilized at normal operating no-load RCS temperature and pressure following the reactor trip. Plant equipment functioned as required, and no unusual conditions were observed for plant equipment following this event. The operations crew responded to the event in accordance with plant procedures. No additional or compensatory measures were required for this event.
Potential Safety Consequences:
The potential safety consequences under alternate conditions are bounded by the plant design. For example, if the turbine trip had failed to initiate the reactor trip as designed, then a loss of heat sink scenario would have resulted. In this case, the plant is protected from a loss of heat sink scenario and subsequent potential over- pressure condition by the high pressurizer pressure reactor trip and from a potential over-temperature condition by the high neutron flux and over-temperature delta-T reactor trips. For a turbine trip, the plant design assumes, "Reactor trip is actuated by the first reactor protection system trip setpoint reached with no credit taken for the direct reactor trip on the turbine trip. Trip signals are expected due to high pressurizer pressure, over- temperature delta-T, high neutron flux, high pressurizer water level, and low-low steam generator water level.
Therefore, no significant safety consequences exist under alternate scenarios that would place the plant in a condition beyond its design bases.
IV. CORRECTIVE ACTIONS
Immediate corrective action was to place the installed spare turbine overspeed sensing probe in service to replace the failed sensing probe.
The electrical turbine overspeed circuit will be modified to remove single-point vulnerability for turbine overspeed sensing probe failures.
The failed turbine overspeed sensing probe will be removed from the system during the next refueling outage (RFO-12), and a forensic analysis will be performed to determine the specific failure mechanism.
The vintage of the speed comparator card will be verified no later than the next refueling outage (RFO-12) to determine if it is susceptible to faults in the output of the amplifier components. If susceptible, the design will be modified.
V. � PREVIOUS SIMILAR EVENTS No previous HNP events or conditions are known related to an electrical failure of the turbine overspeed sensing probe that caused a turbine trip-reactor trip.