05000529/LER-2021-002-01, Reactor Trip During Plant Protection System Surveillance Testing
| ML22032A112 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 01/28/2022 |
| From: | Rash B Arizona Public Service Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 102-08381-BJR/DCE LER 2021-002-01 | |
| Download: ML22032A112 (8) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 5292021002R01 - NRC Website | |
text
BRUCE J. RASH Vice President Nuclear Engineering/Regulatory
Palo Verde Nuclear Generating Station 5801 S Wintersburg Road Tonopah, AZ 85354 Mail Station 7602 Tel 623 393 7362 102-08381-BJR/DCE January, 2022
ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
Dear Sirs:
Subject: Palo Verde Nuclear Generating Station (PVNGS) Unit 2 Docket No. STN 50-529 / License No. NPF 51 Licensee Event Report Supplement 2021-002-01
Enclosed please find Licensee Event Report (LER) 50-529/2021-002-01 that has been prepared and submitted pursuant to 10 CFR 50.73. This LER supplement corrects a minor error in the LER which reported a Unit 2 reactor trip and other specified system actuations that occurred on May 19, 2021.
In accordance with 10 CFR 50.4, copies of this LER are being forwarded to the Nuclear Regulatory Commission (NRC) Regional Office, NRC Region IV, and the Senior Resident Inspector.
Arizona Public Service Company makes no commitments in this letter. If you have questions regarding this submittal, please contact Michael DiLorenzo, Department Leader, Regulatory Affairs, at (623) 393-3495.
Sincerely, Rash, Bruce Digitally signed by Rash, Bruce (Z77439)
DN: cn=Rash, Bruce (Z77439)
(Z77439) Date: 2022.01.28 08:35:48 -07'00'
BJR/DCE
Enclosure
cc: S. A. Morris NRC Region IV Regional Administrator S. P. Lingam NRC NRR Project Manager for PVNGS L. N. Merker NRC Senior Resident Inspector for PVNGS
A member of the STARS Alliance LLC
Callaway Diablo Canyon Palo Verde Wolf Creek
Abstract
On May 19th, 2021, during the periodic scheduled performance of Plant Protection System (PPS) functional testing, an invalid actuation of the Safety Injection Actuation Signal, Containment Isolation Actuation Signal, and Main Steam Isolation Signal (MSIS) of both trains occurred. This led to a reactor trip and the start of the Diesel Generators and Essential Spray Pond pumps. In addition, Low Steam Generator level signals actuated the Auxiliary Feedwater Actuation Signals which started both essential Auxiliary Feedwater pumps.
The Unit 2 reactor tripped because of High Pressurizer Pressure that occurred as a result of a transient initiated by the MSIS actuation and rapid closure of the Main Steam Isolation Valves. This event was initiated by a failure of the Engineered Safety Features Actuation System (ESFAS) test circuit which caused a loss of hold power circuit continuity for critical ESFAS trip paths through the PPS Relay Hold Switch which allowed the trip signals to initiate the applicable plant response. The PPS components involved with the trip were replaced on May 21, 2021, and plant operation was restored.
At the time of the trip, PVNGS Unit 1 was operating at 100 percent power and Unit 3 was in a refueling outage. Neither unit was impacted by the event. No previous similar events have been reported by PVNGS.
All times are Mountain Standard Time and approximate unless otherwise indicated.
1. REPORTING REQUIREMENT(S)
This Licensee Event Report (LER) is submitted pursuant to:
- 10CFR 50.73(a)(2)(iv)(A) as any event or condition that resulted in manual or automatic actuation of the following systems listed in paragraph 50.73(a)(2)(iv)(B):
- - Main Steam Isolation Valves (MSIVs) via Main Steam Isolation Signal (MSIS)
- - Emergency Core Cooling System (ECCS) including high pressure and low pressure safety injection (HPSI and LPSI) via the Safety Injection Actuation Signal (SIAS)
- - Auxiliary Feedwater System (AF) via Auxiliary Feedwater Actuation Signal (AFAS)
- - Containment Spray System (CS) via SIAS
- - Diesel Generator (DG) via SIAS/AFAS
- - Essential Spray Pond (SP) pumps via SIAS/AFAS
- 10 CFR 50.73(a)(2)(v) as a condition that could prevent the fulfillment of a function required to:
(A) Shut down the reactor and maintain it in a safe shutdown condition (D) Mitigate the consequences of an accident
- 10CFR 50.73(a)(2)(ii)(B) for an unanalyzed condition The event was reported to the NRC via the Event Notification System (ENS) (EN 55265) as updated on May 19 and July 2, 2021.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S), AND COMPONENT(S)
Atmospheric Dump Valve (ADV) (EIIS: SB): The ADVs are pneumatically operated and may be opened/closed by the control room operator to control pressure or primary plant cooldown in the event the main condenser and/or steam bypass control system is not available.
Auxiliary Feedwater Actuation Signal (EIIS: BA): During normal power generation, the two AF pumps are in a standby condition. The system is provided with two channels of AFAS (AFAS-1 or -2) corresponding to each Steam Generator (SG). An AFAS will automatically start and align the essential pumps to feed the affected SG upon receipt of a low steam generator water level signal. As long as the affected SG is intact, as evidenced by the existing SG differential pressure (relative to the other SG), the auxiliary feed system will automatically maintain SG level within a prescribed wide range indication band. AFAS is an Engineered Safety Features Actuation Systems (ESFAS) actuation.
Containment Spray System (EIIS: BE): The functional performance objective of the CS as an engineered safety feature system is to reduce the containment temperature and pressure following an analyzed accident, by removing thermal energy from the containment atmosphere. This cooling system also serves to limit offsite radiation levels by reducing the pressure differential between the containment atmosphere and the external environment, thereby diminishing the driving force for leakage of fission products from the containment to the environment. SIAS is one of the actuation signals that will start the CS pumps. However, SIAS will not open the containment isolation valve allowing water to flow into containment.
Diesel Generator (EIIS: EK): The system is a Class 1E standby generation system that functions as a standby source of alternating current (AC) power for safe plant shutdown in the event of loss of preferred (off-site) power. This system includes all necessary auxiliaries to maintain the diesel engine in a readiness condition. Each DG is an independent unit capable of providing power to safety equipment in the event of the loss of the preferred power to safely shutdown the NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 08/31/2023 (08-2020) 1. F A C I L I T Y N A M E 2. DOCKET NUMBER 3. LER NUMBER
Palo Verde Nuclear Generating Station 05000-529 NUMBER NO.
(PVNGS) Unit 2 2021 - 002 - 01
plant or mitigate the consequences of analyzed accidents. Some of the actuation signals which start the DG are AFAS and SIAS as discussed below and above.
Engineered Safety Features Actuation System (EIIS: JE): The system provides initiating signals to components requiring automatic actuation. These actuating signals are generated when monitored variables reach levels that require protective action. The system performs its function by initiating ESFAS equipment if selected abnormal conditions are detected. The setpoints for the actuation signals are selected to minimize the consequences of design basis accidents, which include the fuel handling accident, fire/smoke, and loss of power. The ESFAS provides the following actuation signals (among others) to the Engineered Safety Features (ESF) equipment when the applicable monitored variables reach levels requiring protective action:
- Containment Isolation Actuation Signal (CIAS)
- AFAS
- MSIS Emergency Core Cooling System (EIIS: BP): ECCS is synonymous with Safety Injection (SI) system (EIIS: BP) and is designed to provide core cooling in the unlikely event of an analyzed accident. The ECCS prevents significant alteration of core geometry, precludes fuel melting, limits the cladding metal-water reaction, removes the energy generated in the core and maintains the core subcritical during the extended period of the accident. The SI system accomplishes these functional requirements by use of redundant active and passive injection subsystems. The active portion of the SI system consists of HPSI (EIIS: BQ) and LPSI (EIIS: BP) pumps and associated valves.
Essential Spray Pond (EIIS: BS): The system consists of two independent, redundant safety related flow trains. Each train takes suction from, and returns water to, its associated spray pond. One flow train supplies the cooling water required for plant shutdown to Train A Essential Cooling Water (EW) (EIIS: BI) heat exchanger and Train A DG cooling water heat exchangers (EIIS: LB). The other flow train supplies cooling water to the same items in Train B. Heat is rejected to the SP system, which provides the unit with its Ultimate Heat Sink. The spray pond pumps start automatically in response to ESFAS signals such as an AFAS or SIAS. Either flow train can supply sufficient cooling water to allow a safe plant shutdown independent of the other flow train for analyzed accidents. The SP system is normally in standby during normal power generation and is operated manually to recirculate the system to maintain its chemistry. It is also operated during plant shutdowns or when the emergency DG is in service.
Main feedwater (MFW) (EIIS: SJ): The system consists of piping, main feedwater pumps (MFWPs) (EllS: JK), high pressure heaters, valves, controls, instrumentation, and associated equipment which supply feedwater to the SG. Each MFWP is a turbine-driven pump capable of supplying 65 percent of main feedwater system capacity. There are two MFWPs which serve both SGs. A loss of a single feed pump initiates a Reactor Power Cutback (RPCB) (EIIS: JD),
which drops pre-selected Control Element Assemblies (CEAs) (EIIS Code: AA) and reduces main turbine load to rapidly reduce reactor power. This allows the plant to remain on-line during these events and significantly reduces the requirements for steam bypass valve and MFWP capacity.
Main Steam Isolation Valves (MSIVs)(EIIS: SB): Each of the main steam lines is equipped with one quick acting MSIV.
The MSIVs close on a MSIS generated by either low steam generator pressure, high steam generator level or high containment pressure. The MSIVs fail closed on loss of control or actuation power. Closing the MSIVs isolates each steam generator from the other, and isolates the turbine, Steam Bypass Control system, and other auxiliary steam supplies from the steam generators.
Reactor Coolant System (RCS) (EIIS: AB) is comprised of two main flow loops each of which includes two Reactor Coolant Pumps (RCPs) and one SG. The primary function of the RCPs is to provide the necessary head to maintain forced circulation of reactor coolant through the RCS during normal operations. The reactor coolant leaving the core of the reactor vessel enters two hot legs, one per loop, and flows to the SG (EIIS Code: AB). Critical operation of the (08-2020) 1. F A C I L I T Y N A M E 2. DOCKET NUMBER 3. LER NUMBER
Palo Verde Nuclear Generating Station 05000-529 NUMBER NO.
(PVNGS) Unit 2 2021 - 002 - 01
reactor requires all four RCPs to be in operation to ensure adequate RCS flow. The RCPs are powered from non-class 1E 13.8 kV buses with two RCPs per bus.
Steam Generator (EIIS: AB): During normal operation, the reactor coolant leaving the core of the reactor vessel enters two "hot legs", one per loop, and flows to the steam generators. The hot reactor coolant enters the steam generator through the inlet nozzle in the steam generator primary head. The steam generator is a shell and U-tube heat exchanger with an integral economizer. It operates with the reactor coolant on the tube side and secondary feedwater on the shell side. Primary (reactor) coolant flows through the U-tubes giving up its heat to the secondary feedwater in the shell side of the steam generator. Each SG has two main steam lines which direct steam for use in the steam cycle; Each steam line is provided with five Main Steam Safety Valves (MSSVs) (EIIS: SB), total of 20 MSSVs, which provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the Reactor Coolant Pressure Boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink provided by the Condenser and Circulating Water System, is not available.
The heat added by the reactor coolant causes the feedwater (secondary coolant) to boil thus generating steam for turbine operation. The primary (reactor) coolant and secondary (feedwater and steam) systems are separated and do not come in contact with each other. This design prevents radioactive contamination of the secondary system. The reactor coolant leaves the steam generator through two outlet nozzles. A vertical divider plate separates the inlet and outlet plenums of the primary head. Each outlet supplies the suction leg piping of the reactor coolant pumps.
Plant Protection System (PPS) (EIIS: JC): The system is divided into three different portions. The first portion is the RPS (EIIS: JC), which trips the reactor to protect the core and the reactor coolant system pressure boundary from potentially hazardous operating conditions. A reactor trip opens the Reactor Trip Switchgear (RTSG) breakers (EIIS:AA), de-energizing the Control Element Drive Mechanism (CEDM) (EIIS:AA) coils, allowing all CEAs to drop into the core by gravity. The second portion is the Supplementary Protection System (SPS). The SPS augments the RPS by providing a separate trip logic and diverse initiation of a reactor trip. The third portion is the ESFAS.
The RPS and ESFAS functions are performed across four redundant protection trains labeled A, B, C, and D as discussed below. A signal from any two of the four channels results in the associated reactor trip or ESFAS actuation.
Matrix Test Module (MTM) (EIIS: JC): Each PPS sub-system consists of the instrumentation, signal processing equipment, bistable comparators, logic matrices, initiation relays, controls and indications required for that sub-system to perform its intended function. Four redundant protection channels (A, B, C and D) are used for each trip/actuation function. This circuit provides the necessary means to conduct the PPS functional testing of the RPS/ESFAS logic.
Reactor Protection System: Consists of four independent, redundant channels and includes a number of sensors, calculators (including the core protection calculators (CPCs)(EIIS: JC)), logic circuits, and supporting equipment that monitor nuclear steam supply system (EIIS: AB) parameters. The RPS ensures the reactor is rapidly and reliably shut down to protect the fission product barriers and assist the ESFAS in accident mitigation. When all four channels of RPS are in service, a reactor trip is actuated when two of four channels generate a trip signal as previously discussed. The RPS provides trips for the following conditions, among others:
- Low departure from nucleate boiling ratio (DNBR)
- High and low pressurizer pressure
- High and low steam generator water level
- High containment pressure
- Manual trip A SIAS is generated on either a low pressurizer pressure of 1837 pounds per square inch absolute (psia) or high containment pressure of 3.0 psi gauge (psig). A SIAS, CIAS and reactor trip will occur simultaneously if either of these conditions are met. A SIAS is required in the event of a Loss of Coolant Accident, Main Steam Line Break, or Steam (08-2020) 1. F A C I L I T Y N A M E 2. DOCKET NUMBER 3. LER NUMBER
Palo Verde Nuclear Generating Station 05000-529 NUMBER NO.
(PVNGS) Unit 2 2021 - 002 - 01
Generator Tube Rupture. It actuates the components required for injection of borated water into the reactor coolant system and emergency core cooling, thereby ensuring adequate shutdown margin and minimizing core fuel damage.
A CIAS has the same trip parameters as SIAS. The CIAS initiates isolation of selected process lines penetrating the containment. By isolating the containment: 1) The release of radioactive material to atmosphere is minimized for accidents involving fuel damage and the associated fission product releases. 2) Energy release to the containment that could lead to over pressurization and potential failure is limited in the event of main feedwater or steam system piping ruptures.
An MSIS occurs at the nominal setpoints for steam generator secondary pressure (960 psia), steam generator water level (91.0%), or containment pressure (3.0 psig). The MSIS will isolate the main steam, main feedwater, sample, and blowdown lines on both steam generators regardless of which steam generator (if either) was responsible for the actuation. In the event of a Main Steam Line Break, the MSIS will limit the energy release to containment and prevent excessive containment pressures. By isolating both steam generators, only the damaged steam generator can release its energy. It also prevents a complete blowdown of both steam generators and the resulting loss of heat sink for the reactor core.
3. INITIAL PLANT CONDITIONS
On May 19, 2021, PVNGS Unit 2 was in Mode 1 (Power Operation) at 100 percent power with the RCS at normal operating temperature and normal operating pressure. There were no inoperable structures, systems, or components at the time that contributed to this event.
4. EVENT DESCRIPTION
On May 19th, 2021, a periodic scheduled performance of PPS functional testing of the RPS/ESFAS logic was performed and resulted in a plant trip. The test was on the AC matrix module and included the following sequence:
The test circuit RELAY TRIP selector was rotated to Position 2 to select trip path 2 for actuation. The SYS CHAN TRIP selector was rotated to SIAS/CIAS/MSIS position to start the test on these functions. The RELAY HOLD switch was then taken to the hold position and it was verified that both the HOLD indicator for the selected trip path is OFF (Path 2) and that the HOLD indicators for the remaining trip paths were ON and NOT flickering (Paths 1, 3, 4). After this verification was completed, the RELAY HOLD switch was taken to the TRIP position. With this action, the expected response would have been SIAS/CIAS/MSIS actuation only on trip path 2 and the technicians would have continued through the procedure after verifying all the proper indication lights appropriately changed states for this trip function.
Instead, at approximately 0313 AM, when the RELAY HOLD switch was taken to the TRIP position, an invalid actuation of both trains of SIAS, CIAS, and MSIS occurred. Approximately three seconds after the MSIS, a RPCB was received.
Three seconds after the RPCB, the RPS tripped the reactor on actual High Pressurizer Pressure.
As a result of the MSIS, the MSIVs rapidly closed as designed:
- The reactor trip occurred as a result of the transient caused by the MSIS. The rapid loss of steam flow caused RCS temperature and pressurizer level and pressure to increase, resulting in the reactor trip. The maximum pressure reached during the event was 2415 psia. This pressure is well below the design pressure of 2500 psia and the safety limit of 2750 psia. A total of eight MSSVs lifted to relieve elevated SG pressure and provide initial RCS cooling.
- Steam supply to the MFW pumps was interrupted resulting in the loss of feedwater to the SGs. The water level in both SGs decreased to the AFAS level setpoint, resulting in an AFAS actuation. Both essential AF pumps (08-2020) 1. F A C I L I T Y N A M E 2. DOCKET NUMBER 3. LER NUMBER
Palo Verde Nuclear Generating Station 05000-529 NUMBER NO.
(PVNGS) Unit 2 2021 - 002 - 01
started and provided feedwater to the SGs as required. Operation of the condensate system continued, and condenser vacuum remained intact.
The initial invalid actuation sequence did not require an RPS actuation to trip the reactor because they did not affect associated ESFAS inputs including those that are common to RPS and all parameters were normal. The RPS actuation was required due to the High Pressurizer Pressure that occurred as a result of the transient initiated by the MSIS actuation and rapid closure of the MSIVs.
The SIAS resulted in the actuation of both trains of the HPSI and LPSI pumps, containment spray pumps, DGs, and SP pumps. The Class 1E 4160 VAC busses remained energized from off-site power. Per the actions of the Reactor Trip Procedure to reset the SIAS, operators overrode and closed both A and B trains of HPSI and LPSI injection valves at 0337 AM and stopped both trains of HPSI, LPSI, and CS pumps at 0346. This action rendered both trains of these systems inoperable. By 0931 AM when SIAS and CIAS had been reset, ECCS override signals were removed, safety injection tank (SIT) line pressure alarm was verified less than 1525 psia, and both trains of HPSI, LPSI, and CS were declared OPERABLE.
Post trip follow-up evaluations concluded the following:
- Pumps and valves responded as expected due to the signal but no actual injection into the RCS occurred.
- Unit 2 remained within normal post trip bands for RCS inventory, pressure and temperature. RCS pressure remained above the SIAS setpoint of 1837 psia and containment pressure remained below the SIAS setpoint of 3.0 psig.
- The Unit 2 Operators performed Standard Post Trip Actions and determined all Safety Function Acceptance Criteria were satisfied and then transitioned to the Reactor Trip procedure.
- No operator actions were required to address reactor coolant system pressure or level deviations during the reactor trip recovery.
- No additional Emergency Operating procedures (EOP) were entered; no contingency actions related to RCS inventory and pressure control were required.
- The Reactor Trip procedure was exited, and the operating crew transitioned to General Operating Procedure (Mode 3 to Mode 5), to maintain Mode 3 and stable plant conditions.
The Reactor Trip procedure was followed to reset and restore SIAS/CIAS/MSIS into their standby mode:
- Post-trip Safety Function Acceptance Criteria were re-validated and the procedure guidance to reset the invalid SIAS/CIAS/MSIS was followed.
- At 0337 HPSI pump discharge valves were closed and overridden in accordance with HPSI throttle criteria. At 0346 the LPSI and CS pumps were overridden and secured. This prevented their automatic operation and required entry into Limiting Condition for Operation (LCO) 3.0.3 due to both trains of ECCS and CS being inoperable. This plant configuration in Mode 3 is an unanalyzed condition.
- LCO 3.0.3 was entered at 0337 AM and exited at 0931 AM after the SIAS and CIAS reset process was completed. The SIAS load shed panels were subsequently energized.
At the time of the trip, PVNGS Unit 1 was operating at 100 percent power and Unit 3 was in a refueling outage. Neither unit was impacted by the event. (08-2020) 1. F A C I L I T Y N A M E 2. DOCKET NUMBER 3. LER NUMBER
Palo Verde Nuclear Generating Station 05000-529 NUMBER NO.
(PVNGS) Unit 2 2021 - 002 - 01
5. ASSESSMENT OF SAFETY CONSEQUENCES
This event did not result in a challenge to fission product barriers or result in the release of radioactive materials. The event did not adversely affect the safe operation of the plant or health and safety of the public.
The RPS functioned as designed and initiated an automatic reactor trip that placed the plant in a safe condition. The invalid conditions caused by the invalid ESFAS actuations did not require a reactor trip and the event was not an Anticipated Transient without Scram (ATWS).
Following the invalid ESFAS actuations and the valid RPS actuation, all required plant systems responded as expected and all CEAs fully inserted into the reactor core. No Emergency Plan classification was required, and no safety related components failed to actuate. Furthermore, the ADVs and AF were used for heat removal and to maintain steam generator levels and pressure.
Actions taken with respect to HPSI, LPSI and CS in preparation for the reset of SIAS and CIAS temporarily resulted in both trains of HPSI, LPSI, and CS being inoperable while in Mode 3. Control room operators continued to monitor the plant to ensure safety functions continued to be met. The MFW function was temporarily lost due to the closure of the main feed and steam isolation valves resulting from the MSIS, but they remained available and recoverable using approved plant procedures to feed the steam generators within 30 minutes, if needed.
The Unit 2 reactor trip and the unanalyzed configuration of ECCS and CS while resetting SIAS did not result in a transient more severe than those already analyzed in the Updated Final Safety Analysis Report. Technical Specification safety limits were not exceeded or approached.
6. CAUSE OF THE EVENT
The Unit 2 reactor tripped because of actual High Pressurizer Pressure that occurred as a result of a MSIS actuation.
This event was initiated in the test circuitry by the loss of hold power circuit continuity for critical ESF trip paths through the PPS Relay Hold Switch and Terminal Block (TB701). This momentarily removed the "hold" voltage to the matrix relay test coils that prevent transfer of the matrix relay contacts in the SIAS, CIAS, and MSIS Initiation Logic circuits, which allowed the trip signals to initiate the applicable plant response.
7. CORRECTIVE ACTIONS
The PPS components involved with the trip were replaced on May 21, 2021. Corrective actions are also planned to inspect and if needed replace the corresponding PPS matrix test module components in other units.
In the event additional information is received that results in substantial changes in the corrective actions planned, PVNGS will submit a supplement to this LER.
8. PREVIOUS SIMILAR EVENTS
No previous similar events have been reported by PVNGS.