05000440/LER-2004-002
| Docket Number12 23 2004 2004 - 002 - 00 02 21 2005 | |
| Event date: | 12-23-2004 |
|---|---|
| Report date: | 02-21-2005 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation |
| Initial Reporting | |
| ENS 41290 | 10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation |
| 4402004002R00 - NRC Website | |
I. INTRODUCTION
On December 23, 2004, at 2345 hours0.0271 days <br />0.651 hours <br />0.00388 weeks <br />8.922725e-4 months <br />, both reactor recirculation system (RRC) pumps [AD] at the Perry Nuclear Power Plant (PNPP) unexpectedly downshifted from fast to slow speed.
Prior to the RRC pump speed downshift, the plant was stable in Operational Condition 1 at 100 percent rated thermal power. The reactor pressure vessel (RPV) was at 1020 psig and saturated conditions. Following the downshift, at 2354 hours0.0272 days <br />0.654 hours <br />0.00389 weeks <br />8.95697e-4 months <br /> a reactor scram occurred due to core oscillations being detected by the Oscillation Power Range Monitor (OPRM)[JC]. At the time of the scram, the plant was at approximately 55 percent rated thermal power. All control rods fully inserted as a result of the scram signal.
The primary purpose of the RRC system is to provide forced circulation through the reactor core to achieve full power operation and permit variations in power level without control rod movement. Control interlocks are provided for RRC pumps to automatically downshift the pump from fast to slow speed. These controls are provided to prevent cavitation in RRC system components and mitigate the effects of various operational transients on reactor water level and reactivity. The OPRMs are designed to detect reactor core power oscillations and suppress the oscillations by providing a trip signal to the reactor protection system, which results in a reactor scram.
On December 24, 2004, at 0307 hours0.00355 days <br />0.0853 hours <br />5.076058e-4 weeks <br />1.168135e-4 months <br />, the required non-emergency four-hour notification was made to the NRC pursuant to the requirements of 10CFR50.72(b)(2)(iv)(B), reactor protection system actuation while critical (NRC Event Number 41290). This event is being reported under the requirements of 10CFR50.73(a)(2)(iv), any event or condition that resulted in manual or automatic actuation of any of the specified systems.
II. EVENT DESCRIPTION
At 2345 hours0.0271 days <br />0.651 hours <br />0.00388 weeks <br />8.922725e-4 months <br /> on December 23, 2004, both RRC pumps A and B unexpectedly transferred from fast to slow speed. At the time of RRC pump speed downshift, the plant was stable in Operational Condition 1 at 100 percent rated thermal power. After the downshift, reactor power stabilized at about 44 percent and then gradually increased to about 55 percent rated thermal power. The power and flow reduction placed the plant in the immediate exit region of the power-flow map. In this region, the reactor core is susceptible to power oscillations. At 2346 hours0.0272 days <br />0.652 hours <br />0.00388 weeks <br />8.92653e-4 months <br />, off-normal instruction, "Unplanned Change in Reactor Power or Reactivity," was entered. At 2348 hours0.0272 days <br />0.652 hours <br />0.00388 weeks <br />8.93414e-4 months <br /> the first OPRM alarm was annunciated and subsequently cleared.
The magnitude of the core power oscillations detected by the OPRM instrumentation was not observable to operators monitoring reactor power on the control room instrumentation. The OPRM alarm came in three additional times at 2351, 2352 and 2354 hours0.0272 days <br />0.654 hours <br />0.00389 weeks <br />8.95697e-4 months <br /> also with no observable power oscillations.
At 2354 hours0.0272 days <br />0.654 hours <br />0.00389 weeks <br />8.95697e-4 months <br /> a reactor scram occurred due to OPRM trip signals. All control rods fully inserted. The operators properly entered, off-normal instruction, "Reactor SCRAM". The operators also correctly entered plant emergency instruction, "Reactor Pressure Vessel Control" when the reactor vessel level momentarily decreased as expected below Level 3 (178 inches above the top of active fuel) due to void collapse. Level was restored by the ■ feedwater control system operating in automatic mode. Reactor water level continued to increase to about 230 inches at which time the feedwater pump turbines tripped as designed.
Subsequent level control was with the motor driven feedwater pump.
All control rods inserted, no safety relief valves were opened, no automatic ECCS response occurred, and no ECCS system was used for level control. The reactor water cleanup (RWCU) system [CE] was not available due to the RWCU trip during the scram transient. The RWCU pumps have non-safety electrical power supplies that underwent a voltage transient during the scram and caused the RWCU pumps to trip.
Pressure control was maintained by the turbine bypass valves [SB-V] throughout the transient.
The valves and their control system functioned as designed. The safety relief valves [SB-RV] were not required to automatically respond and were not opened manually.
III. CAUSE OF EVENT
The cause of the SCRAM was determined to be a Reactor Protection System (RPS) scram signal from OPRM Channels NE, B/F and C/G following the RRC pump downshift. The setpoint for Channels D/H was not exceeded. The data review from the OPRMs determined that the OPRMs response during the event was per design with no deficiencies noted. The scram signal was appropriate for the plant conditions.
Although the operating crew was determined to have performed no inappropriate actions, appropriate mitigating strategies (inserting control rods) were not adequate to promptly exit the region of potential instability. The delay in inserting control rods in this event was caused by organizational and programmatic issues, including inadequate training and procedures resulting from a lack of rigor in the management of changes when the OPRM was made operable.
The engineering change process (ECP) was followed when the OPRM modification was implemented, but the change in the operable status of the system was delayed for over 3 years for technical reasons. When the change was finally made to transition to the "OPRMs Operable" status, the ECP process was already completed and therefore there was no process mechanism that re-initiated the assessment of training or procedures.
Because of this, the appropriate training needs analysis was not performed and the operators were not provided with adequate training or procedures that would have provided the basis for more timely actions that could have prevented an automatic scram under the conditions experienced on December 23, 2004.
Troubleshooting of the RRC system pump speed downshift was initiated to identify the cause.
These investigations focused on the RRC pump fast to slow speed downshift logic circuitry.
Three of the five RRC pump downshift signals were eliminated as a potential cause since a scram would have initiated simultaneously with the downshift from those signals.
Since the other sources of pump downshift signals were eliminated, the alarm cards for Low Feedwater Flow and Low Reactor Level were replaced prior to plant restart. These cards were considered the highest probability to have caused the RRC pump downshift based on historical failure trends. Since the RRC pump downshift signal was intermittent and could not definitively be confirmed, temporary recorders were installed to monitor the power supply and input voltage to the two replaced alarm cards and other points in the RRC circuitry.
Subsequent to this event, on January 6, 2005, the RRC pumps again unexpectedly downshifted to slow speed. The cause of the downshift was determined to be an optical isolator intermittent failure as a result of an inadequate surge suppression network in the end of-cycle reactor recirculation pump trip (EOC/RPT) control circuit for the RRC pumps (Reference PNPP LER 2005-001 for further information). This cause was also subsequently determined to be the reason for the RRC pump downshift on December 23, 2004.
IV. EVENT ANALYSIS
The primary purpose of the RRC system is to provide forced circulation through the reactor core to achieve full power operation and permit variations in power level without control rod movement. Control interlocks are provided for the RRC pumps to automatically downshift the pump from fast to slow speed. These controls are provided to prevent cavitation in RRC system components and mitigate the effects of various operational transients.
Analysis of plant conditions at the time of the RRC pump fast to slow speed downshift confirmed that no process parameters or transients required to initiate the above interlocks were present. With the reactor at full power, the RRC pump downshift brought the reactor into the region of potential instability of the power to flow map. Power following the downshift stabilized at approximately 55 percent. The reactor scrammed as a result of exceeding the trip setpoints of the OPRMS. Evaluation of the OPRM event buffer data concluded that reactor core wide oscillations occurred following the RRC pump downshift. The OPRMs did suppress the oscillations by initiating a scram and the minimum critical power ratio (MCPR) safety limit was not exceeded.
The plant response was consistent with and bounded by the Updated Safety Analysis Report (USAR) event analyses for "Decrease in Reactor Recirculation Flow" in Chapter 15.3 which shows that a downshift of both RRC pumps event is bounded by the trip of both RRC pumps event. The plant response following the scram was bounded by USAR Section 15.2.3 for a turbine trip. Thus, this event was determined to be within design evaluation limits A risk assessment was also performed. The computed results were that the probability of core damage for the December 23, 2004 scram was 3.7E-07 and the probability of a large early release was computed to be 4.6E-09. Transients with a core damage probability less that 1.0E-06 and a large early release probability less than 1.0E-07 are not considered to be risk significant events.
Based upon the above information, this event is considered to be of very low safety significance.
V. CORRECTIVE ACTIONS
Interim action to address inadequate training was completed prior to restart including training on the significance and pattern of the OPRM alarms and the urgency for exiting the immediate exit region of the power to flow map.
Following the January 6, 2005 RRC pump downshift, the failed optical isolator was replaced and a diode was installed across the downstream logic trip relay for surge suppression.
Similar optical isolators, that could have been damaged by relay inductive surges, were also replaced.
Additional corrective actions that have been completed or are in progress:
1. Off-normal operating instruction, ONI-051 "Unplanned Change in Reactor Power or Reactivity" was revised so that the operators can go immediately to the required actions.
2. The alarm response instruction was revised to indicate that a reactor scram was possible and to evaluate the need to enter off-normal operating instruction, ONI-051 "Unplanned Change in Reactor Power or Reactivity.
3. Simulator training time will be reviewed to increase off-normal event training including events that have a higher probability to occur.
4. Procedures will be revised to consider training needs when incorporating changes to operational methods and to ensure that training precedes significant changes in operational methods.
5. Analysis of industry BWR power oscillation events will be performed and incorporated into simulator training sessions.
The above actions have been entered in the corrective action program.
VI. SIMILAR EVENTS
Manual Scram due to unexpected Reactor Recirculation Pump downshift, LER 1993-015.
This manual scram was initiated in accordance with procedures in effect at that time when entering the power-to-flow region of core instability. The cause of the downshift was a failure of both RRP suction resistance thermal detectors, which is not similar to the December 23, 2004 event. Optical isolators were specifically evaluated as not being the cause.
Manual scram due to unexpected Reactor Recirculation Pump downshift, LER 1994-002.
This manual scram was initiated in accordance with procedures in effect at that time when entering the power-to-flow region of core instability. The cause of the downshift was a failure of a K1 relay on an alarm card, which is not similar to the December 23, 2004 event.
Automatic scram following unexpected Reactor Recirculation Pump downshift, LER 2001-005.
This automatic scram occurred following a high Reactor Pressure Vessel water level that was initiated by a Reactor Recirculation Pump downshift. The cause of the downshift was a failure of a feedwater system level summer card, which is not similar to the December 23, 2004 event.
The corrective actions from the events above would not have precluded occurrence of this event.
Manual scram due to unexpected Reactor Recirculation Pump downshift and subsequent pump trip to off, LER 2005-001. This scram occurred following the December 23, 2004 scram. This manual scram was correctly initiated based upon multiple unexpected plant responses while in the immediate exit region of the power-to-flow map. The cause of the downshift was a failure of an optical isolator, which was subsequently determined to also be the cause of the December 23, 2004 pump downshift.
Energy Industry Identification System Codes are identified in the text as [XX].