05000440/LER-2001-005
| Perry Nuclear Power Plant | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4402001005R01 - NRC Website | |
I. Introduction Perry Nuclear Power Plant (PNPP) is a Boiling Water Reactor (BWR) with a feedwater system [SJ] consisting of two-50% capacity steam turbine driven pumps [P], required for full power operation, and one-20% capacity motor driven pump. Reactor Pressure Vessel (RPV)[AC] water level is controlled by an automatic feedwater control system [JK]. The feedwater control system provides control signals to the main turbine [TA] and the feedwater pumps high RPV level trips, as well as, control signals to the reactor recirculation [AD] flow control valve runback and to the reactor recirculation pump downshift to slow speed circuits. Additional RPV level signals and control functions are generated in the Reactor Protection System (RPS), Emergency Closed Cooling Systems (ECCS), and for the Nuclear Steam Supply System (NSSS) and Balance of Plant (BOP) containment isolation systems [JM].
RPS generates a scram on high RPV level (Level 8, 219 inches) and on low RPV level (Level 3, 178 inches). As a backup to the scram, the feedwater system generates signals to close the Reactor Recirculation flow control valves and to downshift the Reactor Recirculation pumps from fast to slow speed. Both of these actions will decrease reactor power. Concurrently with the Level 8 scram, feedwater pumps are tripped by the feedwater control system to limit the RPV level increase and the main turbine trips to protect the turbine from water intrusion induced damage. The motor feedwater pump, which is normally not running at full power also receives a Level 8 trip that must be manually reset before the pump can be started. Following the feedwater pump trip, level will decrease through the Level 3 scram setpoint to the RPV low level (Level 2, 130). At Level 2, the reactor recirculation pumps trip, to reduce power if control rods have not inserted. Also at Level 2, the High Pressure Core Spray (HPCS) [BG] system, the Reactor Core Isolation Cooling (RCIC) [BN] system, and their support systems including the HPCS diesel generator [EK], start in order to restore RPV level. When RPV level subsequently reaches Level 8, the HPCS injection valve will close and the RCIC turbine steam supply valve will close terminating the level increase. With no operator action RPV level will eventually decrease to Level 2 once again, automatically reopen the HPCS injection valve and automatically restart the RCIC turbine. RPV level will continue to cycle between Level 2 and Level 8 until operator intervention occurs to further stabilize and take over control of level. Containment isolations also occur at Level 3 and Level 2.
On December 15, 2001, at 2228 hours0.0258 days <br />0.619 hours <br />0.00368 weeks <br />8.47754e-4 months <br />, with the plant operating at 100 percent reactor power, RPV pressure at approximately 1025 psig and all safety systems operable, an excessive feedwater demand transient occurred resulting in RPS Level 8 scram and Level 8 feedwater pump trips. In response to the feedwater pump trips, RPV level decreased causing a Level 2 actuation of HPCS, RCIC, and containment isolation, as designed.
A second RPS scram actuation occurred on low RPV level at 2304 hours0.0267 days <br />0.64 hours <br />0.00381 weeks <br />8.76672e-4 months <br /> when level inadvertently drifted low.
Additionally, the HPCS diesel governor was misadjusted during diesel shutdown resulting in inoperability that was later identified during the review of normal surveillance testing results on December 21, 2001. Since the error was not I immediately detected, Technical Specification 3,8.1 "AC Sources-Operating" Required Actions B and F were not completed in the required completion time.
An NRC notification was made via the Emergency Notification System at 0030 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> on 12/16/01, (ENF 38575), in accordance with the requirement of 10CFR50.72 (b)(2)(iv)(A), for ECCS Injection, 10CFR50.72(b)(2)(iv)(B), as an event that resulted in an actuation of the Reactor Protection System when the reactor is critical and 10CFR50.72(b)(3)(iv), for specified system actuations, which in this case includes the RPS and HPCS systems, as well as, the NSSS and BOP containment isolation systems.
This event is being reported in accordance with the requirements of 10CFR50.73(a)(2)(iv), a condition that resulted in specified system actuation's, 10CFR50.73(a)(2)(i)(B), a condition prohibited by Technical Specifications, and also satisfies PNPP's Operational Requirements Manual (ORM) section 7.6.2.1, which requires a special report submittal following an ECCS actuation and injection into the RPV. This was the fourteenth HPCS injection to date. The injection nozzle usage factor is currently less than 0.70.
II. Event Description
On December 15, 2001, at 2228 hours0.0258 days <br />0.619 hours <br />0.00368 weeks <br />8.47754e-4 months <br />, with the plant operating at 100 percent reactor power, an excessive demand feedwater transient occurred. The resultant transient caused an automatic RPS reactor scram and an automatic trip of both the operating turbine-driven reactor feedwater pumps, due to a valid RPV Level 8 signal. Subsequently, the RPV level decreased to Level 2 causing a RPS actuation, an automatic initiation of HPCS and RCIC, an automatic trip of the reactor recirculation pumps, and containment isolation. These automatic actions occurred in a relatively short time period without complication. Proceduralized Operator actions were initiated to stabilize RPV level by removing HPCS from service at 2231 hours0.0258 days <br />0.62 hours <br />0.00369 weeks <br />8.488955e-4 months <br /> and allowing RCIC to continue to recover level until it shutoff as required when reaching RPV level 8.
Following the initial level transient, operators identified that the Reactor Water Cleanup system (RWCU) inboard containment isolation valve, G33-F0001, did not automatically close as required. The outboard containment isolation valve, G33-F004, did close as required to provide isolation of the containment penetration. Operators appropriately closed the inboard valve approximately 25 minutes following the isolation signal using the control switch in the control room. Without flow from the recirculation pumps, or through the RWCU system, in conjunction with relatively cool water from the control rod hydraulic system entering the bottom of the RPV, indicated temperatures exceeded the heatup and cooldown rate administrative limits for the reactor recirculation loops. Additionally, the cooldown rate administrative limit for the RWCU piping connected to the reactor bottom head was also exceeded. In response, operators reset the scram at 2246 hours0.026 days <br />0.624 hours <br />0.00371 weeks <br />8.54603e-4 months <br /> and restored the RWCU system to operation to improve circulation and minimize thermal stratification.
After verifying proper alignment and availability of the MFP, the Level 8 trip was reset and the pump was started at 2258 hours0.0261 days <br />0.627 hours <br />0.00373 weeks <br />8.59169e-4 months <br /> and thereafter operated in manual on the startup level controller to provide RPV level control. While controlling level, at 2304 hours0.0267 days <br />0.64 hours <br />0.00381 weeks <br />8.76672e-4 months <br />, the Operator inadvertently allowed level to decrease to Level 3, which caused an additional RPS actuation. RPV level was expeditiously restored to the normal operating band by use of the MFP, and the scram signal was reset at 2313 hours0.0268 days <br />0.643 hours <br />0.00382 weeks <br />8.800965e-4 months <br />.
Later, on December 21, 2001, as a result of normal surveillance testing, it was identified that the HPCS diesel had 0 I been improperly shutdown during recovery from the event. The mis-adjustment resulted in the diesel generator failure to meet Technical Specification 3.8.1 surveillance allowable value for rated speed and frequency start time. Although the HPCS diesel frequency was impacted, engineering evaluation determined that the HPCS system and its supporting systems, also powered from the HPCS diesel-generator, were capable of performing their safety function. It was determined that the diesel generator output breaker would have closed in about 8.8 seconds and stayed closed and that the HPCS and ESW pump would have provided their required design flows.
III. Cause of Event
The cause of the initial RPV level transient was determined to be a failure of the feedwater system level summer card.
The card failure resulted in a false low RPV level indication and resultant response by the feedwater system.
The cause of the second RPS actuation was due to inattentive operator oversight. Manual control of the feedwater system was required to control RPV level due to the summer card failure. The operator assigned with maintaining level became distracted by other duties, allowing RPV level to drift down. Since the scram signal had been reset and although all control rods were fully inserted, the level drift resulted in a Level 3 RPS actuation.
The cause of the HPCS diesel failure to operate properly, following post scram restoration, was determined to be from mis-adjustment of the diesel governor by the operator when the diesel was shutdown. The operator over-adjusted the governor prior to opening the generator output breaker. With the governor mis-adjusted, when the diesel was started on December 21 for routine surveillance testing, the diesel did not attain the required stable RPM required time interval I (13 seconds), instead was 1 RPM low. The required stable speed was achieved at 16.4 seconds. Although the HPCS diesel did not meet the surveillance acceptance criteria, engineering analysis determined that the HPCS pump and supported systems that are powered from the HPCS diesel-generator, were capable of performing their safety function.
The cause of the G33-F001 containment isolation valve failure to close was due to failure of the isolation logic relay(s).
The valve itself operated as expected when operated by the control room control switch.
IV. Safety Analysis
The USAR Section 15.1.2 transient, "FEEDWATER CONTROLLER FAILURE - MAXIMUM DEMAND" bounds this scram event. The USAR analyzed event commences at full power and normal operating pressure and results in maximum peak power of 124.3% power and a maximum peak dome pressure of 1,163 psig, which significantly exceeds the conditions that occurred during this event. All systems responded as described in the bounding analysis.
However, as a consequence to the reactor recirculation pumps tripping off, the RWCU system isolation and the HPCS and RCIC injection, heatup and cooldown rates greater than administrative limits were experienced in the recirculation loops, within the RWCU piping exiting the reactor and in the area of the vessel bottom head. The engineering review of the recirculation piping heatup and cooldown and RWCU piping / vessel bottom head cooldown concluded it was bounded by previous engineering analysis, GE-NE-B13-01805-142. These heatup and cooldown rates are a long-term fatigue monitoring issue, and therefore are not an immediate operational concern.
In summary, this event was reviewed and determined to be within design evaluation limits, and therefore was determined not to be safety significant.
The Plant's staff calculated a Conditional Core Damage Probability (CCDP) value for the reactor scram due to the feedwater controller failure. All significant systems and components were available during the event and the plant was assumed to operate as designed. The calculated CCDP for the event was 2.8 E-7. Using NRC guidance of a threshold, the event was not considered risk significant.
V. Similar Events oxidation of the contact at the fuse to fuse-holder interface. The corrective action was to replace the fuse, perform thermography on all control room fuses and to include control room fuses in the on-going thermography program. The December 15 event was caused by a component(s) failure on a Bailey summer card, therefore these corrective actions would not be readily expected to prevent a summer card failure.
VI. Corrective Actions
1. The failed summer card was replaced to correct the feedwater control problem.
2. Replacement of the Bailey feedwater system with a digital system is planned for Refuel Outage 10.
3. The failed relays for RWCU were replaced.
4. Lessons learned from the event are being communicated to the operators through on-shift training and formal requalification training sessions, which includes simulator operations.
5. The procedure to shutdown the HPCS Diesel-generator was revised to verify that the governor is properly adjusted prior to opening the output breaker followed by post-shutdown verification.
The above events and corrective actions have been entered in the Plants Corrective Action Program.
Energy Industry Identification System (EIIS) codes are identified in the text as [xx].