05000458/LER-2014-002
| River Bend Station - Unit 1 | |
| Event date: | 10-17-2014 |
|---|---|
| Report date: | 08-17-2016 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 4582014002R01 - NRC Website | |
REPORTED CONDITION
On October 17, 2014, at approximately 3:03 a.m. CDT, a reactor scram occurred in response to a high neutron flux signal from the average power range monitors (APRMs). The plant was operating at 100 percent power at the time.
Immediately prior to that signal, an apparent malfunction in the main turbine electro-hydraulic control (EHC) [JI] system caused both the main turbine steam bypass valves to fully open, and also commanded all four main turbine control valves to close. The resulting increase in reactor steam pressure caused reactor power to immediately rise to the trip setpoint of the APRMs, at which point the actuation of the reactor protection, system (RPS) [JC] occurred.
As explained below, the malfunction of the EHC system potentially affected the trip setpoint of certain safety-related instrumentation, and thus constituted an event that could have caused the loss of safety function of the affected instruments.
All reactor control rods inserted as designed in response to the RPS actuation, and operators implemented the appropriate response procedures. After the scram occurred, an operator in the auxiliary control room erroneously removed all the main condensate system demineralizers [SF] from service, isolating condensate flow to the suction header of the main feedwater pumps [SJ]. The "C" feedwater pump tripped on low suction pressure; the "A" and "B" feedwater pumps had been previously secured by the operators. The mis-operation of the demineralizer system was promptly recognized and corrected, and the main feedwater system was restored to service within approximately six minutes. In the interim, reactor water level decreased to Level 3, causing a second actuation of the RPS system, but remained well above the point at which actuation of the emergency core cooling sytems is required. The Level 3 signal also caused an automatic actuation of the containment isolation valves in the suppression pool cooling system, as designed. Reactor recirculation pump "B" failed to downshift to slow speed, and instead, tripped off. A controlled plant cooldoim was commenced, and proceeded into cold shutdown conditions.
This event is being reported in accordance with 10CFR50.73(a)(2)(iv) as an automatic actuation of the RPS system, and in accordance with 10CFR50.73(a)(2)(v) as a condition that potentially caused the loss of safety function of the affected RPS instruments.
INVESTIGATION and IMMEDIATE ACTIONS 1. EHC Malfunction An investigation team was formed to analyze the operating parameters of the EHC system and determine the source of the malfunction.
Earlier in that same shift, there were two actuations of the main control room alarm indicating that the turbine steam bypass valves were open. At 7:26 p.m., the alarm actuated and immediately cleared. Plant computer data indicated that both bypass valves had opened slightly, while the number 4 turbine control valve closed slightly. No accompanying changes were noted in reactor pressure or in any EHC parameters. At 11:14 p.m., the alarm actuated a second time.
Computer data then showed that turbine bypass valve no. 1 had fully opened, and bypass valve no. 2 had opened approximately 20 percent. Turbine control valve no. 4 closed significantly, and there was a slight change in the turbine steam flow reference signal in the EHC system.
Following the first actuation of the TURBINE BYPASS VALVE OPEN alarm, the operators appropriately recorded an entry and exit from the limiting condition for operation (LCO) for three safety-related functions for which the turbine bypass valves are assumed to be closed to support operability of the function. Those functions are reactor protection system (turbine stop valve closure and turbine control valve closure), end-of-cycle recirculation pump trip (EOC-RPT), and control rod block. Technical Specifications require that these functions must be enabled when reactor power is greater than or equal to 40% of rated capacity. This is normally accomplished automatically by turbine first stage pressure instruments.
At the appropriate power level, pressure switches actuate to arm the trip circuitry.
If a turbine bypass valve opens during power operations, reactor steam pressure will be maintained constant by the main turbine electro-hydraulic control system. The automatic response to the opening of a bypass valve is a corresponding closure of the turbine control valves, leading to a decrease in turbine first stage pressure. If this occurs while reactor power is within a few percent above the point at which the safety functions described above are automatically enabled, then it is possible that those functions will be disabled. In this scenario, the required functions will be inoperable at a point where the plant design basis assumes that their safety function is enabled. Therefore, to consider these functions operable, the turbine bypass valves must remain shut when reactor power is greater than or equal to 40% of rated .
capacity. This condition constituted a potential loss of safety function of the affected instruments.
Analysis of EHC parameters immediately prior to the scram found that the steam flow reference signal went from 92 percent to negative 41 percent with no corresponding change in total steam flow demand. The error in the steam flow reference signal cleared in approximately five seconds, but the resulting pressure transient had caused the reactor scram by that point. The movements of the bypass valves and turbine control valves was appropriate for the loss of the steam flow reference signal.
A detailed circuit analysis was performed to identify which components within the system could cause the loss of this signal. Efforts to recreate the loss of the signal were unsuccessful. Based on the system response earlier in the shift, and the lack of any apparent fault, it was concluded that an intermittent failure with the steam flow reference signal was occurring.
The investigation initially postulated that failure in any of these five EHC circuit cards and their subcomponents could have caused this event:
- pressure load gate amplifier
- control valve amplifier input standby transfer
- load limit set runback analog / logic
- control valve flow reference signal
- load limit and load set runback All these circuit cards, except one, were replaced and sent to the vendor for analysis. Discussion with vendor concerning the load limit and load set runback card concluded that its potential role as a source of the failure was extremely low.
If a definite cause of the EHC malfunction is found, that information will be provided in a supplement to this report.
2. Mis-operation of the main feedwater system When the operators in the auxiliary control room heard the plant announcement of a reactor scram, they began removing main condensate demineralizers from service to maintain proper system parameters for the expected decrease in feedwater flow. However, they inappropriately isolated all the demineralizers, isolating all flow to the main feedwater pump suction header. Main control room operators had already secured two of the three pumps; the last pump tripped on low suction pressure. The error was promptly recognized, and demineralizers were restored to service, allowing the re- start of a feedwater pump.
A human performance error review was conducted, which found the following:
- The auxiliary control room operators did not correctly follow the system operating procedure guidance on maintaining flow though individual demineralizers within specifications as overall system flow decreased. The operators imposed unnecessary haste by focusing on demineralizer channeling effects, and did not demonstrate knowledge of integrated system operation.
- Procedural guidance for the removal of condensate demineralizers from service following a scram was less than adequate, in that it promoted the practice that operators in the field have the authority to determine when they can perform actions without specific direction from the main control room.
- Operations department management had not clearly defined standards and expectations to preclude auxiliary operators from taking actions without direction from main control room operators, or a supervisor, during certain plant conditions. In this event, the condensate demineralizers were removed from service and then returned to service without direction from main control room, with the intent of not distracting those operators from the scram recovery. The system operating procedure promotes this long-standing practice.
CORRECTIVE ACTION TO PREVENT RECURRENCE
1. EHC malfunction During the upcoming refueling outage in February 2015, an evaluation of a potential replacement of the obsolete card will be completed. A complete replacement with a digitial EHC system is planned for the refueling outage to occur in early 2017. These actions are being tracked in the corrective action program.
2. Mis-operation of the main feedwater system The system operating procedure for the main condensate demineralizers has been revised to clarify the precautions regarding how many demineralizers are to remain in service. The scram response procedure has been revised to add a step for the main control room operators to communicate with the auxiliary control room operator regarding system operations.
PREVIOUS OCCURRENCE EVALUATION
No event reported by RBS within the last three years was caused by unexplained, erratic signals originating within the main turbine EHC control circuits. ( == SAFETY SIGNIFICANCE ==
When the main turbine EHC system began to display anomalous behavior, the reactor was operating at 100% power. The total steam flow capacity of the turbine bypass valves corresponds to approximately 10% reactor power. Therefore, when the system perturbations occurred prior to the failure which initiated the reactor scram, it is not passible that the required safety functions could have been disabled. Even with both bypass valves open, the response of the main turbine EHC system would be to close the turbine control valves only far enough to compensate for the diversion of 10% of full steam flow to the main condenser. At 100% power, this action could not have resulted in a decrease in turbine first stage pressure sufficient to disable the TS trip functions. Therefore, neither of the transients that occurred in the EHC system earlier in the shift constituted an actual loss of the safety function of the affected instruments.
At the time of the reactor scram, the reactor core isolation cooling system was out of service for planned maintenance. No plant parameters that would have required its actuation were exceeded. No other engineered safety features were out of service at the time. The plant response to this transient was as designed. Thus, this event was of minimal significance to the health and safety of the public.
(NOTE: Energy Industry Identification System component function identifier and system name of each component or system referred to in the LER are annotated as ("XX**) and [XX], respectively.)