05000440/LER-2005-001
| Docket Number01 06 2005 2005 -0001 -000 02 21 2005 | |
| Event date: | 01-06-2005 |
|---|---|
| Report date: | 02-21-2005 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| ENS 41310 | 10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation |
| 4402005001R00 - NRC Website | |
I. INTRODUCTION
On January 6, 2005, at 0106 hours0.00123 days <br />0.0294 hours <br />1.752645e-4 weeks <br />4.0333e-5 months <br />, while operating at approximately 100 percent rated thermal power with stable conditions, the Perry Nuclear Power Plant (PNPP) reactor recirculation system (RRC) [AD] pumps A and B unexpectedly downshifted from fast to slow speed. Reactor power decreased to approximately 44 percent power. This power and flow reduction placed the plant in the immediate exit region of the power-flow map. A similar unexpected downshift from fast to slow speed of both RRC pumps occurred on December 23, 2004, which was reported in PNPP Licensee Event Report (LER) 2004-002.
At 0110 hours0.00127 days <br />0.0306 hours <br />1.818783e-4 weeks <br />4.1855e-5 months <br />, while operators were inserting control rods in accordance with off normal operating instruction ONI-051, "Unplanned Change in Reactor Power or Reactivity", RRC pump A unexpectedly tripped from slow speed to off. At 0112 hours0.0013 days <br />0.0311 hours <br />1.851852e-4 weeks <br />4.2616e-5 months <br />, a manual reactor scram was initiated by the control room crew. All control rods [AA] fully inserted.
The RRC system consists of two independent piping loops, each with a two speed recirculation pump, a flow control valve (FCV), and associated piping and instrumentation external to the vessel, and jet pumps internal to the vessel. The primary purpose of the RRC system is to provide forced circulation through the reactor core to achieve full power operation and permit variations in power level without control rod movement. Control interlocks are provided for the RRC pumps to automatically downshift the pump from fast to slow speed.
II. EVENT DESCRIPTION
On January 6, 2005, at 0106 hours0.00123 days <br />0.0294 hours <br />1.752645e-4 weeks <br />4.0333e-5 months <br />, while operating at approximately 100 percent power, the Perry Nuclear Power Plant (PNPP) RRC pumps A and B unexpectedly downshifted from fast to slow speed. Reactor power decreased to approximately 44 percent power. This power and flow reduction placed the plant in the immediate exit region of the power-flow map. In this region, the reactor core is susceptible to power oscillations due to higher power relative to core flow. Control room operators entered off normal operating instruction ONI-051, "Unplanned Change in Reactor Power or Reactivity" and began to insert the specified control rods.
At 0110 hours0.00127 days <br />0.0306 hours <br />1.818783e-4 weeks <br />4.1855e-5 months <br />, while operators were inserting control rods, RRC pump A unexpectedly tripped from slow speed to off, resulting in single loop RRC operation. At 0112 hours0.0013 days <br />0.0311 hours <br />1.851852e-4 weeks <br />4.2616e-5 months <br />, the reactor operator, with the concurrence of the control room Senior Reactor Operator (SRO), inserted a manual reactor scram, based upon conservative plant operations by the control room crew.
All control rods fully inserted.
As anticipated, reactor water level decreased to Level 3 (178 inches above top of active fuel) immediately following the scram. Level was restored by the feedwater system [SJ] operating in automatic on the master level controller. Reactor level increased to Level 8 (219 inches above top of active fuel). At Level 8, the non-safety related reactor feedwater pump turbines tripped as designed to terminate feedwater addition to the reactor. Level continued to increase due to control rod drive hydraulic water addition and swell until level reached 226 inches.
At 0114 hours0.00132 days <br />0.0317 hours <br />1.884921e-4 weeks <br />4.3377e-5 months <br />, the turbine generator was manually tripped. At 0119 hours0.00138 days <br />0.0331 hours <br />1.967593e-4 weeks <br />4.52795e-5 months <br />, following reactor level reduction below Level 8, operators attempted to manually start the non-safety related motor feedwater pump (MFP) [SJ-P] to control level. The pump failed to start when taken to start following two attempts. At 0122 hours0.00141 days <br />0.0339 hours <br />2.017196e-4 weeks <br />4.6421e-5 months <br />, a reactor core isolation cooling (RCIC) pump [BN] was started for injection to the reactor vessel and continued to provide reactor level control.
Pressure control was maintained by the turbine bypass valves [SB-V] until 0210 hours0.00243 days <br />0.0583 hours <br />3.472222e-4 weeks <br />7.9905e-5 months <br />, when the main steam isolation valves (MSIVs) were closed to limit reactor vessel cooldown. Once the MSIVs were closed, the RCIC System, which was being used for level control, was also utilized for pressure control. The safety relief valves [SB-RV], were not required to automatically respond and were not opened manually. No automatic Emergency Core Cooling System (ECCS) response was required.
There were no other structures, systems or components that were inoperable at the start of the event (other than the MFP as described above) that contributed to the event.
On January 6, 2005, at 0401 hours0.00464 days <br />0.111 hours <br />6.630291e-4 weeks <br />1.525805e-4 months <br />, the required non-emergency four-hour notification was made to the NRC pursuant to the requirements of 10 CFR 50.72(b)(2)(iv)(B), reactor protection system actuation while critical (NRC Event Number 41310). This event is being reported under requirements of 10 CFR 50.73(a)(2)(iv), any event or condition that resulted in manual or automatic actuation of any of the specified systems.
III. CAUSE OF EVENT
The cause of the reactor scram was a manual initiation by the reactor operator. The operator actions to initiate this manual scram were appropriate considering the plant conditions and within management expectations.
Troubleshooting of the RRC pump speed downshift instrument loops was initiated to identify potential component failures. A similar unexpected RRC downshift event occurred approximately two weeks earlier on December 23, 2004 [See PNPP LER 2004-002].
It was determined that the downshift originated from an optical isolator in the end-of-cycle RRC pump trip (EOC/RPT) circuitry for the B logic. An optical isolator is used for physical separation of safety and non-safety circuits.
The EOC/RPT trip is a safety supplement to the reactor protection system [JC], which will automatically initiate a RRC pump downshift to slow speed after a main turbine trip. A relay was found to have 40 VDC across its coil supplied from an optical isolator output, when voltage should have been 0 VDC. The sequence of events recorded during both the December 23, 2004 and the January 6, 2005 RRC high to slow speed downshift events could be duplicated during testing with 40 VDC being applied from the output of the subject optical isolator. The failure mechanism for the optical isolator was overvoltage stress, which caused the output transistor on the optical isolator to fail. The installed resistor/capacitor surge suppression network was insufficient to protect the output transistors from the inductive kick experienced during normal operation, thus providing the source for electrically overstressing of the optical isolator card. This inadequate suppression design made the optical isolator sensitive to normal high level electrical fast transient noise, which allowed an intermittent malfunctioning output.
The cause of the RRC A tripping from slow speed to off was a failure of an amplifier circuit on the voltage regulator card [EC] in the low frequency motor generator (LFMG) which supplies electrical power to the RRC pump A at slow speed. The failure caused a momentarily loss of voltage from the LFMG A generator followed by a rapid recovery to near rated voltage seven seconds later. The ensuing attempt of the LFMG A to restore voltage to the RRC pump motor resulted in a generator over-current relay trip and lock out the LFMG A generator output breaker.
The cause of the motor feedwater pump failure to start was due to the closing springs in the 15 KV electrical supply breaker not being charged. With the breaker closing springs not charged, it is not possible to close the breaker and start the pump from the control switch.
The breaker's charging springs were not charged due to the closing spring charging link arm striking the cubicle floor-mounted interference plate (also known as a rejection plate) used within 15 KV non-safety related 15 HK ABB electrical supply breaker cubicles. This interference plate, which was in its design location, is positioned to ensure that a breaker with a different electrical current rating can not be installed in its cubicle. Additionally, misalignment of the racking rails contributed to the contact of the spring charging link arm with the interference plate. The physical contact dissipates some kinetic energy to the operating mechanism and can intermittently result in the breaker timing cam failing to rotate sufficiently to actuate the control device and energize the closing spring charging motor. This is a legacy design deficiency.
A lack of full organizational commitment for the program implementation of the Problem Solving and Decision Making Process contributed to the ineffectiveness in determining the cause of the December 23, 2004 RRC pump downshifting event and is a contributing cause of the January 6, 2005 RRC pump downshifting event.
IV. EVENT ANALYSIS
The primary purpose of the RRC system is to provide forced circulation through the reactor core to achieve full power operation and permit variations in power level without control rod movement. Control interlocks are provided for the RRC pumps to automatically downshift the pump from fast to slow speed. These controls are provided to prevent cavitation in RRC system components and mitigate the effects of various operational transients.
Analysis of plant conditions at the time of the RRC pump fast to slow speed downshift confirmed that no process parameters or transients requiring initiation of the above interlocks were present. With the reactor at full power, the pump speed downshift placed the reactor in a region of potential instability on the power-flow map, although no power oscillations were observed. Actual power after the downshift transient was determined to be approximately 44 percent. Following off normal operating instructions, the control room crew began inserting control rods. However, the reactor was subsequently manually scrammed as a conservative decision by the control room crew given both the unexpected downshift of both RRC pumps and the subsequent unexpected tripping of one RRC pump to off. All control rods inserted, no safety relief valves were opened, no automatic ECCS response occurred, and no ECCS system was used for level control.
The plant response was consistent with and bounded by the Updated Safety Analysis Report (USAR) event analyses for "Decrease in Reactor Recirculation Flow" in Chapter 15.3 which shows that a downshift of both RRC pumps event is bounded by the trip of both RRC pumps event. The plant response was also consistent with and bounded by the USAR event analysis for "Recirculation System Single Loop Operation" in Chapter 15.0.5.3 and in Appendix 15F.
The recirculation system single loop operation evaluation indicates that PNPP can safely operate with a single recirculation loop out-of-service at up to approximately 67 percent of rated thermal power. The plant response following the manual scram was bounded by USAR Section 15.2.3 for a turbine trip. Thus, this event was determined to be within design evaluation limits.
A risk assessment was also performed. The computed results were that the probability of core damage for the January 6, 2005, scram was 8.7E-07 and the probability of a large early release was computed to be 4.9E-09. Transients with a core damage probability less that 1.0E-06 and a large early release probability less than 1.0E-07 are not considered to be risk significant events.
Based upon the above information, this event is very low safety significance.
V. CORRECTIVE ACTIONS
The failed optical isolator in the RRC logic was replaced with a modified card using diodes in place of the resistor/capacitor surge suppression network. Additional optical isolator cards that had been subjected to similar conditions as the failed card were replaced with the modified cards.
The LFMG A voltage regulator was replaced. Actions were initiated to identify and correct degrading LFMG voltage regulator trends prior to equipment failure.
The interference plate was removed from the floor of the motor feedwater pump's 15 KV electrical supply cubicle. Interference plates in other 15 KV breakers that exhibited wear were also removed.
Training will be provided to the appropriate site personnel on the Problem Solving and Decision Making process "NOP-ER-3001", their roles and responsibilities in the process, management's expectations and the standards required to be followed to ensure the process is implemented as written.
The above events and corrective actions have been entered in the plant corrective action program.
VI. PREVIOUS SIMILAR EVENTS
Manual Scram due to unexpected Reactor Recirculation Pump downshift, LER 1993-015.
This manual scram was initiated in accordance with procedures in effect at that time when entering the power-to-flow region of core instability. The cause of the downshift was a failure of both RRC pump suction resistance thermal detectors, which is not similar to the January 6, 2005 event. Optical isolators were specifically evaluated as not being the cause.
Manual Scram due to unexpected Reactor Recirculation Pump downshift, LER 1994-002.
This manual scram was initiated in accordance with procedures in effect at that time when entering the power-to-flow region of core instability. The cause of the downshift was a failure of a K1 relay on an alarm card, which is not similar to the January 6, 2005 event.
Automatic Scram following unexpected Reactor Recirculation Pump downshift, level that was initiated by a RRC pump downshift. The cause of the downshift was a failure of a feedwater system level summer card, which is not similar to the January 6, 2005 event.
The corrective actions from the above events would not have precluded occurrence of this event.
Automatic Scram following unexpected Reactor Recirculation Pump downshift, (OPRM ) actuation. The cause of the downshift was thought to be a failed low feedwater flow or low reactor water level sensing card. The subsequent pump downshift, which occurred on January 6, 2005, was determined to be due to a failed optical isolator, which was also subsequently determined to be the cause for the prior pump downshift on December 23, 2004.
Although the cause of the downshift was the same, the corrective actions for the OPRM scram were judged effective since the correct operator actions were in progress to exit the immediate exit region of the power to flow map. No OPRM alarms were received indicating that an automatic scram was unlikely to have reoccurred. The RRC pump tripped to off, causing the control room crew to manually scram the reactor in this event.
Energy Industry Identification System Codes are identified in the text as [XX].