05000280/LER-2024-001, Troubleshooting Initiated Unknown Turbine Trip Feature in Control System

Troubleshooting Initiated Unknown Turbine Trip Feature in Control System

ML24212A077
Person / Time
Site:	Surry
Issue date:	07/30/2024
From:	Denise Wilson Virginia Electric & Power Co (VEPCO)
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
24-230 LER 2024-001-00
Download: ML24212A077 (1)

LER-2024-001, Troubleshooting Initiated Unknown Turbine Trip Feature in Control System

Event date:
Report date:
2802024001R00 - NRC Website

text

10CFR50.73

Virginia Electric and Power Company Surry Power Station 5570 Hog Island Road Surry, Virginia 23883

July 30, 2024

U.S. Nuclear Regulatory Commission Serial No.: 24-230 Attention: Document Control Desk SPS: MMT Washington, D. C. 20555-0001 Docket No.: 50-280 License No.: DPR-32

Dear Sir or Madam:

Pursuant to 1 0CFR50. 73, Virginia Electric and Power Company hereby submits the following Licensee Event Report applicable to Surry Power Station Unit 1.

Report No. 50-280 I 2024-001-00

This report has been reviewed by the Station Facility Safety Review Committee and will be forwarded to the Management Safety Review Committee.

• ** 1, /2_

David H. Wilson Site Vice President Surry Power Station

Enclosure Commitment contained in this letter: None

cc: U.S. Nuclear Regulatory Commission, Region II Marquis One Tower, Suite 1200 245 Peachtree Center Ave., NE Atlanta, GA 30303-1257

NRC Senior Resident Inspector Surry Power Station

Abstract

On June 2, 2024, at 1708 hours0.0198 days <br />0.474 hours <br />0.00282 weeks <br />6.49894e-4 months <br /> with Unit 1 at 13% power, Unit 1 experienced an automatic reactor trip due to a turbine trip.

Upon synchronizing Unit 1 turbine generator to the grid, the Turbine Control System (TCS) did not transition to load control as expected. TCS troubleshooting identified that the Breaker Cycling Test mode was active, inhibiting the control system response to breakers being closed. While disabling Breaker Cycling Test mode, the breaker status points were taken off scan. This action initiated an unexpected turbine trip and automatic reactor trip. The turbine trip initiation was caused by a flawed TCS trip logic design. The flawed trip logic rendered a Remote IO failure indication on the TCS Remote IO Failure Trip where no failure existed.

The TCS was returned to a normal configuration for turbine startup, an extent of condition review of the Ovation System for additional unrecognized trips was performed, and TCS indicators and controls were updated in station operating procedures. The health and safety of the public were not affected by this event.

This report is being submitted pursuant to 10 CFR 50.73(a)(2)(iv)(A) as an event that resulted in the automatic actuation of the Reactor Protection System.

1.0 Description of the Event On June 2, 2024, at 1708 hours0.0198 days <br />0.474 hours <br />0.00282 weeks <br />6.49894e-4 months <br />, during Unit 1 startup following the completion of a scheduled refueling outage, Unit 1 automatically tripped from 13% power due to a Turbine trip greater than P-7 (10% power). Upon synchronizing Unit 1 turbine generator to the grid, the Turbine Control System (TCS) (EIIS System JJ, Component DCC) did not transition to load control as expected. MWs slowly increased to 50 MWe with no other actions taken. TCS troubleshooting identified that the Breaker Cycling Test mode was active, inhibiting the control system response to breakers being closed. The operating crew remained diligent in monitoring the unit. All critical parameters such as reactor power, steam generator levels, pressurizer pressure, and pressurizer level remained relatively stable during this time. The operating crew was not challenged by the slow increase in load. Manually tripping the reactor was considered and determined to result in a more severe transient compared to the slow increase in electrical load. A value was established for manually tripping the reactor if the load increase continued. The unit stabilized at a level below this threshold.

A troubleshooting sheet was developed and tested on the simulator. The troubleshooting sheet would allow disabling Breaker Cycling Test mode and the TCS to be swapped to load control. While disabling the Breaker Cycling Test mode, the breaker status points were taken off scan. This action initiated an unexpected turbine trip and automatic reactor trip.

The turbine trip initiation was caused by a flawed TCS trip logic design. The flawed trip logic rendered a Remote IO failure indication on the TCS Remote IO Failure Trip where no actual failure existed. The automatic reactor trip was uncomplicated and all control rods fully inserted into the core. There was no emergency core cooling system (ECCS) or auxiliary feedwater system actuation, and the operating crew responded as expected. There were no inoperable structures, systems or components that contributed to the event.

The TCS was returned to a normal configuration for turbine startup, an extent of condition review of the Ovation System for additional unrecognized trips was performed, and station operating procedures were updated. This report is being submitted pursuant to 10 CFR 50.73(a)(2)(iv)(A) as an event that resulted in the automatic actuation of the Reactor Protection System.

2.0 Significant Safety Consequences and Implications

No significant safety consequences resulted from this event. The health and safety of the public were not affected by this event.

3.0 Cause of the Event

The cause of the event was a flawed TCS trip logic design resulting in a TCS Remote IO Failure Trip. The trip logic was flawed in that a Remote IO failure was indicated on the TCS Remote IO Failure Trip where no failure existed. The trip logic was made up with the flawed Remote IO failure indicated concurrent with 2/2 Output Circuit Breakers (OCBs) indicating Bad quality.

4.0 Immediate Corrective Action

The TCS was returned to a normal configuration for turbine startup including returning the OCB points to scan, turning off the Breaker Cycling Test Mode, and forcing input to the Primary Control Module to clear input to impacted AND gate.

The Vendor and Dominion Engineering performed a review for additional unrecognized trips associated with the Ovation System and found no additional unrecognized trips. Procedures for Turbine-Generator Startup to 20%-25% Turbine Power were revised to include steps to perform TCS Alarm Screen and TCS Forced or Off Scan Point review in accordance with the procedure for TCS Ovation Operation, and added steps to check that the Bypass Sync Check Relay and the Breaker Cycling Test buttons are inactive. Additionally, the TCS Ovation Operation procedure was revised to enhance reviews of the TCS Alarm Screen and review TCS Forced or Off Scan Points.

5.0 Additional Corrective Actions

Corrective Actions to Address Contributing Causes (CACC) were developed to address procedural review requirements (electronic and non-electronic), specific guidance requirements when developing digital design changes (to include software functionality), training analysis for troubleshooting procedure, revise guidance for Owners Review tracking of open items to resolution, and adding supervisory review requirements for Owners Review in guidance document.

6.0 Actions to Prevent Recurrence Correct flawed identified TCS trip logic for both Unit 1 and Unit 2 Turbine Control Systems.

7.0 Similar Events

No similar events have been noted at Surry.

8.0 Additional Information

The health and safety of the public were not affected by this event. There was no impact to Unit 2.