ML18038B709

LER 96-005-00:on 960510,unit Automatically Scrammed on Low Reactor Water Level Due to Runback of Reactor Feed Pumps. Caused by Inadequate Design of Digital Feedwater Control Sys Software.Design Change Implemented

ML18038B709
Person / Time
Site:	Browns Ferry
Issue date:	06/10/1996
From:	William Jones TENNESSEE VALLEY AUTHORITY
To:
Shared Package
ML18038B708	List: ML18038B707 ML18038B709
References
LER-96-005-01, LER-96-5-1, NUDOCS 9606140071
Download: ML18038B709 (18)

Text

NRC FORM 366 NUCLEAR REGULATORY COMMISSION PPROVED BY OMB NO. 3150%104 (44)5) . EXPIRES 04/30/96 ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THIS MANDATORYINFORMATlON COLLECTION REQUEST:

50.0 HRS. REPORTED LESSONS LEARNED ARE LXCENSEE EVENT REPORT (LER), INCORPORATED INTO THE UCENSING PROCESS AND FED BACK TO INDUSTRY. FORWARD COMMENTS REGARDING (See reverse for required number of BURDEN ESllMATE TO THE INFORMATIONAND RECORDS digits/characters for each block) MANAGEMENT BRANCH rr+ F33), US. NUCLEAR REGULATORY COMMISSION, WASHINGTON, DC 205554001, FACIUTY NAME II) oocKET NUMBER IT) PAOE P)

Browns Ferry Nuclear Plant (BFN) Unit 2 05000260 1 OF 9 TITLE (i)

Unit 2 Scrammed On Low Reactor Water Level Due To The Digital Feedwater System Reinitializing Its Feed Pump Demand Output Signal To Zero And The Subsequent Trip Of The Reactor Core Isolation Cooling On High Exhaust EVENT DATE 5) LER NUMBER 6 REPORT DATE OTHER FACIUTIES INVOLVED 6)

FACIUTY NAME SEQUENTIAL REVISION YEAR MONTH DAY YEAR NUMBER NUMBER NA 05000 05 10 96 '6 005 00 06 10 96 FACILITYNAME DOCKET NUMBER 05000 OPERATING THIS REPORT IS SUBMITTED PURSUANT TO,THE REQUIREMENTS OF 10 CFR: Chock ono or more) 11)

MODE (9) N 20.2201(b) 20.2203(a)(2)(v) 50.73(a)(2)(0(8) 50.73(a)(2)(viii) 20.2203(a)(1) 20.2203(a)(3)(i) 50.73(a)(2)(il) 50.73(a)(2)(x)

POWER LEVEL (10) 100 20.2203(a)(2)(i) 20.2203(a)(3)(li) 50.73(a)(2)(iii) 73.71 20.2203(a)(2)(ii) 20.2203(a)(2)(iii) 20.2203(a)(4) 50.36(c)(1) 50.73(a)(2)(lv) 50.73(a)(2)(v) S 'n OTHER Abstract boloN or lnlntRC Form 366A 20.2203(a)(2)(iv) 50.36(c)(2) 50.73(a)(2)(vii)

UCENSEE CONTACT FOR THIS LER 12 TELEPHoNE NUMBER Irncrudo Atoa code)

William C. Jones, Compliance Licensing Engineer (205) 729-7857 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT 13)

CAUSE SYSTEM COMPONENT MANUFACTURER TO NPRDS REPORTABLE CAUSE SYSTEM, COMPONENT MANUFACTURER REPORTABLE TO NPRDS SUPPLEMENTAL REPORT EXPECTED 14 MONTH DAY .YEAR EXPECTED YES SUBMISSION (It yes, complete EXPECTED SUBMISSION DATE).

X NO DATE (15)

ABSTRACT (Limit to 1400 spaces, l.e., approximately 15 singlempaced typewritten lines) (16)

.On May 10, 1996, at approximately 1024 hours0.0119 days <br />0.284 hours <br />0.00169 weeks <br />3.89632e-4 months <br />, Browns Ferry Unit 2.was operating at 100 percent power when the unit automatically scrammed on low reactor water level due to a runback of two of the three reactor feed pumps. This occurred while sofbvare parameter changes were being made on the newly installed digital feedwater control system.

When the sofbvare parameter changes were made active (i.e., saved), a reinitialization sequence automatically occurred within the control sofbvare "block," which drove the feed pump speed demand signal to zero for a period of a few seconds. This resulted in a low reactor water level which caused various Engineered Safety Feature (ESF) and Reactor Protection System actuations. The cause of this event is inadequate design of the digital feedwater control system software. Specifically, the system will relnitialize its feed pump demand output signal to zero during software parameter changes in the digital feedwater control system in some of the software blocks provided (5 of 380). This system characteristic was outlined by the vendor as eliminated from the software design and was not known to the BFN plant staff. Plant safety systems responded as expected for this type of'event. This condition is reportable in accordance with 10 CFR 50.73(a)(2)(lv) as a condition that resulted in manual or automatic actuation of ESFs.

Reactor Core Isolation Cooling (RCIC) tripped on high exhaust pressure during its stattup transient. A design change implemented during the Unit 2 Cycle 8 refueling outage replaced the turbine exhaust check valve with a model having more reliability and leak tightness repeatabilitI(/. The valve was also a.lift check in lieu of a swing check which resulted in slightly higher operating exhaust pressure. Since the system did not function as required, RCIC was determined to be inoperable'since the stattup on April 24, 1996. Manual Initiation of RCIC would not have resulted in the high exhaust pressure trip due to the different valve alignments and the timing of these manipulations. Therefore, the system was available for manual operation had it been needed. Following the successful. completion of a rated-pressure flow test at normal operating pressure, RCIC was declared operable on May 15, 1996. This condition is also reportable in accordance with 10 CF R 50.73(a)(2)(i)(B) as a condition prohibited by the plant's technical specifications.

'9606i/I007i 9606i0 PDR ADOCK 05000260 S PDR

0 <

~ i L

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION

~ (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACZLZTX NAHE NUMBER NUMBER Browns Ferry Unit 2 05000260 2 of 9 96 -- 005 00 r

TEXT mora space is raquir ~ use a iuooa copies o orm (17)

z. PLANT CONDZTZONS At the time of this event, Units 2 and 3 were operating at 100 percent power. Unit 1 was shutdown and defueled.

ZZ. DESCRZPTZON OF EVENT Event On May 10, 1996, at approximately 1024 hours0.0119 days <br />0.284 hours <br />0.00169 weeks <br />3.89632e-4 months <br />, Unit 2 automatically scrammed on low reactor water level. The low water level resulted from a runback of two of the three reactor feedwater pumps [SK] which unexpectedly occurred while software parameter changes were being made in the digital feedwater control system [JB]. When the software parameter changes were made active in the control system, a reinitialization sequence automatically occurred which drove the feed pump speed demand signal to zero for a few seconds.

This was followed by the system ramping the signal back up to the level appropriate for the current reactor conditions. This system output transient was too severe to maintain reactor water level within the prescribed range, and the reactor automatically scrammed when the vessel level reached +11.2 inches. At -45 inches the High Pressure Coolant Injection (HPCI) system [BJ] and the RCIC system [BN] auto initiated and injected into the Reactor Coolant System. The RCZC subsequently tripped on high exhaust pressure.

In addition to the above actuations, the scram caused actuations or isolations of the following Primary Containment Isolation System [JE] (PCIS) systems/components.

~ PCIS group 2, Shutdown cooling mode of Residual Heat Removal

[BO]; Drywell floor drain isolation valve and Drywell equipment drain sump isolation valve [WP].

~ PCIS group 3, Reactor Water Cleanup [CE].

~ PCIS group 6, Primary Containment Purge and Ventilation

[JM]; Reactor Zone Ventilation [VB]; Refueling Zone Ventilation [VA]; Standby Gas Treatment [BH] system; and Control Room Emergency Ventilation [VI].

~ PCIS group 8, Transverse Incore Probe [IG] withdrawal.

Plant safety systems responded as expected for this type of event.

NRC FORM 366A (4-I)

0 ~5, NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION

(~

LZCENSEE EVENT REPORT (LER)

TEXT CONTINUATION LER NIMBER NUMBER NUMBER Browns Ferry Unit 2 05000260 3 of 9 96 -- 005 00 EXT more space is requir, use s irioos copies orm {17)

RCIC turbine exhaust pressure during RCIC startup exceeded the turbine exhaust high pressure trip setpoint of 25 resulted psig and RCIC tripped, TVA has determined that this condition addition of from the higher operating back pressure caused by the a more reliable exhaust check valve. during the preceding refueling outage and that RCIC had been inoperable since April 24, 1996.

Manual initiation of RCIC would not have resulted in the high exhaust pressure trip due to the different valve alignments and the timing of these manipulations. Therefore, the system was available for manual operation had it been needed.'he plant scram is reportable in accordance with 10 CFR 50.73(a)(2)(iv) as a condition that resulted in manual or automatic actuation of an ESF. Additionally, inoperability of the RCIC is being reported in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by the plant's technical specifications.

B. Zno rable Structures, Co onents, or S stems that Contributed to the Event:

None C. Dates and roximate Times of Ma or Occurrences:

May 10, 1996, at 1024 Reactor scram on low water level

(+11.2").

May 10, 1996, at 1025 RCIC turbine tripped on high exhaust pressure.

May 10, 1996, at 1030 Scram was reset.

May 10, 1996, at 1124 TVA made a 1-hour notification to NRC in accordance with 10 CFR 50.72 (b)(1)(iv). A 4-hour report was made in accordance with 10 CFR 50.72 (b) (2) (ii) .

May 15, 1996, at 1515 LCO was exited after successful completion of a rated-pressure flow test at normal operating pressure, and RCIC was declared operable.

s For further details of the RCIC isolation, see Section II.D.

NRC FORM 366A (445)

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION

~ (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION DOCKET LEK NVMBIHt NUMBER NUMBER Browns Ferry Unit 2 05000260 4 of 005 00 9'6 EX more space requrr, use a rona cop>es o orm (17)

D. Other S stems or Seconda Functions Affected:

RCIC tripped on high turbine exhaust pressure during its startup transient. The higher exhaust pressure is attributed to a modification performed during the preceding refueling outage in which the turbine exhaust discharge check valve [CKV] was replaced with a model having more reliability and leak tightness repeatability. The valve was also a lift swing check which resulted in higher operating exhaust pressure check in lieu of a which exceeded the high turbine exhaust trip setpoint during the staztup transient. Pressure drop across the new valve was larger than anticipated in the design primarily because turbine injection flow and steam flow peak significantly above their rated values during the startup transient when injecting into the vessel. A des'.gn change was subsequently implemented to raise the trip setpoint from 25 psig to 50 psig, and RCIC was declaredoperable on May 15, 1996, after successful completion of a rated-pressure flow test at normal operating pressure.

E. Method of Discove The reactor scram and RCIC turbine trip were discovered when the control room Operations personnel [licensed, utility] received alarms and indicators that the reactor tripped due to a .sensed low reactor water level condition and the RCIC turbine tripped on high exhaust pressure.

erator Actions:

Once the reactor scrammed, Operations personnel responded to the scram in accordance with appropriate procedures, and the reactor was stabilized and safely brought to a shutdown condition.

Safet S stem Res onses:

All safety systems responded to the reactor scram as designed for this type of event.

ZZZ. CAUSE OF THE EVENT'.

Zmmediate Cause:

Reactor Scram The immediate cause of the reactor scram was the runback of two of three reactor feedwater pumps while the reactor was at full power. Reactor water level lowered to the scram setpoint in approximately 11 seconds.

NRC FORM 366A (4-95)

~I (Qi NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4.95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACZLZTX HAME LEK NUMBER NUMBER NUMBER Browns Ferry Unit 2 05000260 5 of 9 96 005 00 IIIOfO SpSCO IS fOqUIf, USO IUOAS COplOS orm (1 )

RCIC Turbine Tzi The immediate cause of the RCIC turbine trip was implementation of the design change which replaced the, turbine exhaust check valve with one having higher flow losses.

B. Root Cause:

Reactor Scram The zoot cause of the reactor scram was inadequate design of the digital feedwater control system software. Specifically, the system is designed to be highly fault tolerant, and was specifically installed on Unit 2 to help reduce feedwaterweakness system related scrams and plant transients. However, a design existed in the installed system in that five software blocks (i.e., logic functions performed by the computer) would automatically reinitialize to zero output after software changes were made. The system was understood by BFN personnel to have been designed so as to not have such a characteristic.

RCIC Turbine Tri The root cause of the RCIC turbine trip was inadequate evaluation of the effect of the higher back pressure zesulting from the valve .replacement. The new lift check valve was designed and installed to improve containment leak rate performance and had been successfully used in the same application at other plants. While the increase in back pressure was small compared to the operating margin to the setpoint at steady state conditions, the increase became large enough during the startup transient to exceed the existing setpoint. The personnel directly involved in the design change were not aware that other plants had raised their high turbine exhaust pressure trip setpoint to 50 psig as part of a Boiling Water Reactor (BWR) Owners Group effort which prevented this issue from surfacing at other plants. The inczeased setpoint would have prevented the trip from occurring.

As a result of NRC's review of the requirements for RCIC operability, NRC identified a failure to comply with the procedural requirements of the inservice inspection program following the replacement of the RCIC (and HPCI) exhaust check valves. The procedure requires that a full rated flow test be performed if the valves are replaced to ensure check valve functionality. A full flow test at 1,000 psig was initially scheduled to be performed. However, it was subsequently deleted because another full flow test at 150 psig pressure was scheduled to be performed as part of a scheduled surveillance test. The 150 psig flow test was performed and was evaluated as also meeting IST requirements, but no revision to the original NRC FORM 366A (4-95)

41 NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (445)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACZLZTY HAHE NUMBER NUMBER Browns Ferry Unit 2 05000260 6 of 9 96 005 00 SXT more space rs reqwr ~ rrse a rrroea copes ofm 17) procedure requiring testing at 1,000 psig was made.

C. Contributin Factors:

Reactor Scram Existing BFN work control administrative practices are oriented to specifically address maintenance, modifications, and testing on plant hardware. Design, procurement, V&Vr maintenance, and testing processes on systems which involve software are not as well defined.

In addition, a weakness in communication between Engineering personnel [non-licensed, utility] and shift Operations personnel was noted. Specifically, Operations personnel were not aware the software parameter changes were being made at the time.

RCIC Turbine Tri A contributing factor to the RCIC turbine trip was a difference between the rated turbine steam flow from original General Electric specifications (-28000 ibm/hr) used as a design assumption and the actual value of -38000 ibm/hr. This further reduced the operating marg'in to the exhaust pressure setpoint.

ZV. ANALYSIS OF THE EVENT Reactor Scram Loss of feedwater flow due to feedwater control system failures (feedwater pump trips) is evaluated in the final safety analysis report as an abnormal operational transient. The ESF actuations and.

safety systems functioned as designed during the scram. Based on the review of the plant system and operator response, there were no operator or automatic actions which could have precluded this scram.

There was insufficient time for the event to be diagnosed and manual control taken .of the system before the scram occurred. Since the feedwater pump trips were bounded by the Final Safety Analysis Report, TVA concludes that this transient dxd not significantly affect plant safety, and the safety of plant personnel and the public was not compromised.

RCIC Turbine Tri The RCIC system is not relied 'upon to mitigate design basis accidents and, therefore, fa'ilure of the system does not compromise core cooling. The safety systems designed for emergency core, cooling with the reactor at high pressure are HPCI and Automatic Depressurization System in conjunction with Low Pressure Cooling Injection or Core Spray system. These systems were available throughout the time period when RCIC was inoperable to ensure adequate coze cooling.

NRC FORM 366A (4.95),

0 l P NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATZON NUMBER NUMBER Browns Ferry Unit 2 05000260 7of9

'96 005 00 EX more space rs requs, use amrra copres orm 1 )

Therefore, TVA concludes that plant safety was not adversely affected, and the safety of plant personnel and the public was not compromised as a result of these events.

V. CORRECTZVE ACTZONS A. Zmmediate Corrective Actions:

Reactor Scram The reactor was brought to a stable condition and safely brought to a shutdown condition in accordance with the appropriate site procedures.

'RCZC Turbine Tri TVA issued a design change to adjust the switch trip,setpoint prior to zestarting the unit. Additionally, a static governor check was performed and minor adjustments made. On May 15, 1996, a rated-pressure flow test was successfully conducted at system operating pressure and the RCIC was declared operable.

B. Corrective Actions to Prevent Recurrence:

Reactor Scram

1. All 380 digital feedwater system software blocks have been checked on the BFN simulator subsequent to the scram to determine if other blocks could cause system perturbation.

when, software parameter changes are made. Four additional deficiencies were identified. Prior to restart, the affected software blocks were modified to eliminate the problem.

2. A vendor representative from the Foxboro Company, evaluated the system for any additional problems.

3. A memorandum was issued to Site Engineering personnel emphasizing that software parameters are design output and that changes to design output software require controls similar to those for hardware changes.

NRC FORM 366A (445)

Ol ig I

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION LER HUMBER NUMBER NUMBER Browns Ferry Unit 2 05000260 8 of 9 96 -- 005 -- 00 T more space rs reqmr, use a asrna copes

4. A BFN High Impact Team will be formed to evaluate current methods of designing, procuring, testing, training, and performing field work on equipment which utilizes software.

The team will make recommendations to BFN management concerning appropriate changes to the current work control administrative practices.*

5. The appropriate Engineering personnel were briefed on the management expectation that all changes to process controlling software be specifically communicated to Operations prior to implementation.

.RCIC Turbine Tri Appropriate personnel corrective actions have been taken with the individuals involved in the preparation of the design change. An independent engineering evaluation of the event has been performed and the results will be incorporated into the Site Engineering Training program. Additionally, these individuals have been briefed on management expectations with to complete and accurate technical evaluation of a plant 'egard design change, considering both design and actual system performance data.

The procedural requirements for the inservice testing program will be strengthened with regard to control of testing activities. The changes will be completed by June 26, 1996.

VZ. ADDZTZONAL ZNFORMKTZON A. Failed Co onents:

None B. Previous LERs on Similar Events:

Numerous events within the industry and at BFN have occurred regarding feedwater systems. ,However, the cause of this event is directly related to the specifics of the digital feedwater control system installed at BFN during the Unit 2 Cycle 8, refueling outage. 'Hope Creek and Brunswick are the only other BWRs which have similar systems installed. No events similar to this have been experienced at either plant.

2 TVA does not consider this action a Regulatory Commitment. That is, this action is not required to restore compliance with oblicIations. Obligation means an action that is a legally binding requirement imposed through applicable rules, regulations, orders, and licenses. The TVA corrective action program will track completion of this corrective action.

NRC FORM 366A (4.95)

4i IQ!':

~,

ll

NRC,FORM 366A U.S. NUCLEAR REGULATORY

(~ COMMISSION'ICENSEE EVENT REPORT (LER)

TEXT CONTINUATION LER NUMBER NUMBER NUMBER Browns Ferry Unit 2 '05000260 9of9 96 005 -- 00 EX more space rs reqwr, use a itious cop>es orm 1 )

VZZ. COMCZQMENTS The procedural requirements for the inservice testing program will be strengthened with regard to control of testing activities. The changes will,be completed by, June 26, 1996.

Energy Industry Identification, System (EIIS),system and component codes are identified in the text with brackets (e.g., [XX]),.

NRC FORM 366A (4-95)

>