05000529/LER-2001-002

LER-2001-002,

Docket Number
Event date:	07-13-2001
Report date:	08-31-2001
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function
Initial Reporting
5292001002R00 - NRC Website

NAME

Daniel G. Marks. Section Leader. Reaulatory Affairs TELEPHONE NUMBER (Include Area Code) 623-393-6492 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13) CAUSE SYSTEM COMPONENT MANU- FACTURER

TO EPIX

X SB CBD V124 Y SUPPLEMENTAL REPORT EXPECTED (14) EXPECTED I SUBMISSIONDATE (15)

MONTH DAY YEAR

YES (If yes, complete EXPECTED SUBMISSION DATE) X NO ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines) (16) On July 13, 2001, at approximately 0821 Mountain Standard Time, Unit 2 was in Mode 1 (POWER OPERATION), when a logic board and pin connector in the "B" Train Main Steam and Feedwater Isolation System failed causing three of four main steam isolation valves (MSIVs) to close. The reactor tripped from 100% power on Reactor Protective System Low Departure from Nucleate Boiling Ratio (DNBR). This DNBR trip was due to an auxiliary trip generated by all four Core Protection Calculator channels. The auxiliary trip was the asymmetric steam generator transient trip function based on cold leg temperature differences between the two steam generators. All Control Element Assemblies fully inserted. Two SG #2 Main Steam Safety Valves lifted as expected due to the MSIVs fast-closing.

The primary plant was stabilized in Mode 3 (HOT STANDBY) with forced circulation with both steam generators being used for heat removal via the atmospheric dump valves. The event did not adversely affect the health and safety of the public.

In the past three years there have been no similar events reported where a failed logic board in the Main Steam and Feedwater Isolation System logic cabinet caused the closure of MSIVs and a subsequent reactor trip.

1. REPORTING REQUIREMENT(S):

This LER (50-529/2001-002-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(iv)(A), to report a reactor protection system (RPS) (EIIS: JC) initiated reactor trip which occurred on July 13, 2001 at approximately 0821 Mountain Standard Time (MST).

On July 13, 2001 at 1051 MST, APS made notification of the event to the Nuclear Regulatory Commission (NRC) via the emergency notification system (ENS# 38138).

2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):

The paragraphs in this section provide brief descriptions of the major equipment and systems that were relied upon, influenced, or had a significant function in this event.

Main Steam and Feedwater Isolation Actuation System (MSFIS) (EIIS: SB) The MSFIS is a solid-state digital class lE system which provides signals to energize and de- energize control solenoids which open, close, or exercise the plant main steam isolation valves (MSIVs) (EIIS: SB, ISV) and feedwater isolation valves (FWIVs) (EIIS: ISV). The MSFIS utilizes solid-state digital circuits for all system logic and timing functions while maintaining compatibility with other systems through input isolation relays and output relays.

Reactor Protection System (RPS)(EIIS: JC) The RPS provides a rapid and reliable shutdown of the reactor to protect the core and the reactor coolant system pressure boundary from potentially hazardous operating conditions. Shutdown is accomplished by the generation of reactor trip signals. The trip signals open the reactor trip switchgear (RTSG) breakers (EIIS: AA, BRK), de-energizing the control element drive mechanism (CEDM) coils (EIIS: AA), allowing all control element assemblies (CEAs)(EllS: AA) to drop into the core by the force of gravity.

Main Steam Isolation Valves (MSIV)(EIIS: SB) The main steam isolation valves are hydraulic actuated, double disc, gate valves. One of four MSIVs (two per steam generator) is installed on each 28-inch main steam line just downstream of the main steam safety valves (MSSVs) (EllS: SB). The MSIVs are designed for rapid positioning and will close automatically within seconds following receipt of a main steam isolation signal. MSIV controls are provided in the control room. Each MSIV is provided with an independent, self-contained hydraulic actuator and two independent, redundant and opposite train powered hydraulic supply systems. A main steam isolation signal from either train will actuate one hydraulic actuator per valve and all four MSIVs will close.

3. INITIAL PLANT CONDITIONS:

On July 13, 2001, at approximately 0821 MST, Palo Verde Unit 2 was in Mode 1 (POWER OPERATION), operating at approximately 100 percent power. There were no major structures, systems, or components that were inoperable at the start of the event that contributed to the event.

4. EVENT DESCRIPTION:

On July 13, 2001, Unit 2 was operating at approximately at 100% power, when Steam Generator (SG) #2 Lines 1 and 2 Main Steam Isolation Valves (MSIV) and SG#1 Line 2 MSIV fast-closed (at 08:21:53 MST) causing a rapid decrease in secondary side heat removal. The reactor tripped from 100% power on RPS Low Departure from Nucleate Boiling Ratio (DNBR) (at 08:21:59 MST). This DNBR trip was due to an auxiliary trip generated by all four Core Protection Calculator channels. The auxiliary trip was the asymmetric steam generator transient trip function based on cold leg temperature differences between the two steam generators. All Control Element Assemblies (CEAs) fully inserted. Two SG #2 Main Steam Safety Valves (MSSV) lifted as expected due to the MSIV fast- closing.

The control room staff entered the applicable emergency operations procedures and diagnosed the event as a reactor trip. The Shift Manager classified the event as an 6 uncomplicated reactor trip. No Engineered Safety Features Actuation System (ESFAS)(EIIS: JA) actuations occurred nor were any required. The plant was stabilized in Mode 3 (HOT STANDBY) with forced circulation with both steam generators used for heat removal. Heat removal from SG#1 was initially accomplished by the Steam Bypass Control System (SBCS) (EIIS: JI). Heat removal from SG#2 was initially accomplished via the MSSVs. Feedwater to both steam generators was provided by the B train main feedwater pump (EIIS: SJ). The Atmospheric Dump Valves (ADVs)(EIIS: SB) and the motor driven non-essential auxiliary feedwater pump were subsequently used for heat removal and secondary inventory control.

5. ASSESSMENT OF SAFETY CONSEQUENCES:

The plant responded as required the reactor trip was uncomplicated, no safety limits were exceeded, and the event was bounded by current safety analyses. This event proceeded as would be expected for a loss of heat removal caused by rapid closure of three of the four MSIVs. Analysis of the available data indicates that the plant protection system responded as required. The reactor tripped from 100% power on RPS Low DNBR. This DNBR trip was due to an auxiliary trip generated by all four Core Protection Calculator channels. The auxiliary trip was the asymmetric steam generator transient trip function based on cold leg temperature differences between the two steam generators.

Primary and secondary pressure boundary limits were not exceeded as a result of the reactor tripping from a steady state condition. The transient did not cause any violation of the safety limits (i.e., departure from nucleate boiling ratio, linear heat rate, pressurizer pressure). Therefore, there were no adverse safety consequences or implications as a result of this event. This event did not adversely affect the health and safety of the public.

The failure of the logic board and pin connector in the Main Steam and Feedwater Isolation System (MSFIS) logic cabinet is not a condition that alone could have prevented the fulfillment of a safety function as defined by 10CFR50.73(a)(2)(v).

6. CAUSE OF THE EVENT:

An independent investigation of this event was conducted in accordance with the APS corrective action program. The investigation revealed that the MSIV fast-closure was the result of a "B" train logic card failure. The root cause was a random component failure in a system that was not designed to be single failure tolerant.

Specifically, a faulted and burned "transzorb" (a voltage surge protection element similar in function to a zener diode) caused the "B" train MSFIS logic card to output intermediate values. Steam Generator #1 MSIV 180 and Steam Generator #2 MSIVs 171 and 181 responded to the intermediate logic card output by fast-closing. Continued degradation of the "B" train MSFIS logic card resulted in a condition where MSIV 180 slowly opened.

APS chose not to close MSIV 180 in order to preserve the Equipment Root Cause of Failure Analysis (ERCFA) evidence as much as possible since closure was not required or desired by plant conditions.

No unusual characteristics of the work location (e. g., noise, heat, poor lighting) directly contributed to the event. No personnel errors or procedural error contributed to this event.

7. CORRECTIVE ACTIONS:

Control room personnel took immediate action to place the reactor in a stable condition in accordance with the appropriate operating procedures.

MSFIS control cabinet 2-JSG-B-001 was quarantined and actions were commenced to troubleshoot and, if necessary, repair equipment. The MSIV logic card and its edge connector were replaced. The troubleshooting plan was implemented to inspect the other logic cards in this chassis and to retest the logic card for MSIV-180. A complete retest of the other "B" Train logic was also completed. Portions of the "A" side logic for MSIV-180 were also retested.

APS reactor engineering performed a review of post trip data and concluded that the Safety Limits (DNBR, Linear Heat Rate, and Pressurizer Pressure) were not exceeded.

6 Unit 2 plant performance and plant protection system evaluations were performed to determine plant responses to the transients experienced during this event. The plant performance evaluation included a safety function impact analysis for each of the safety functions and included an assessment of equipment malfunctions, abnormal alarms and/or events observed during the event. The results of the plant performance evaluation concluded the plant responded as designed and well within the bounds of analysis of record.

Any additional corrective actions taken as a result of the investigation of this event will be implemented in accordance with the APS corrective action program. APS is evaluating modification options to make the logic system more fault tolerant to prevent recurrence. If information is subsequently developed that would significantly affect a reader's understanding or perception of this event, a supplement to this LER will be submitted.

8. PREVIOUS SIMILAR EVENTS:

In the past three years there have been no similar events reported where a failed logic board in the Main Steam and Feedwater Isolation System logic cabinet caused the closure of MSIVs and a subsequent reactor trip. Previously on August 26, 2000, (LER 50- 529/2000-001-00) Unit 2 tripped due to a failure of the MSFIS power supply in the Train "A" cabinet due to a transistor failure. Two previous failures were also experienced with logic cards that caused single MSIVs to open and close, respectively, but did not cause a reactor trip.

9. ADDITIONAL INFORMATION:

The reactor trip was a single actual initiating event that affected only the initiating event cornerstone in the regulatory oversight and assessment process. The event was tabulated as an Unplanned Scram, and an Unplanned Scram with Loss of Heat Removal, in the performance indicator cornerstone of initiating events.

6