05000247/LER-2008-003
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 2472008003R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On April 21, 2008, during power ascension following a scheduled refueling outage, with reactor power at approximately 35 percent, Operations initiated a manual reactor trip (RT) {JC} at 11:24 hours, as a result of observing decreasing steam generator (SG) levels and loss of main turbine-generator load due to a main turbine runback. All control rods {AA} fully inserted and all primary systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}. There was no radiation release. The Emergency Diesel Generators {EK} did not start as offsite power remained available. The Auxiliary Feedwater System (AFWS) {BA} automatically started as expected due to a Steam Generator (SG) {AB} low level as a result of SG void fraction (shrink) effect. On April 21, 2008, at 1424 hours0.0165 days <br />0.396 hours <br />0.00235 weeks <br />5.41832e-4 months <br />, a 4-hour non emergency notification was made to the NRC for an actuation of the reactor protection system {JC} while critical and included an 8-hour notification for a valid actuation of the AFW System under 10CFR50.72(b)(3)(iv)(A) (Event Log # 44153). The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2008-02334. A post trip evaluation was initiated and completed on April 21, 2008.
Investigation found a failed bistable permissive (PC-412B-1) in the loss of main boiler feedwater pump (MBFP) main turbine runback system. This system was designed to runback the main turbine generator from 100 percent power to approximately 76.5 percent on a loss of one of two MBFPs. Control valves are used to regulate steam to the main turbine during normal operation. Control valve positioning uses high pressure oil from the turbine control oil system to move a servomotor piston. Control oil pressure on the servomotor piston originates from three controllers; 1) two main turbine Load Limit valves, 2) main governor, and 3) auxiliary governor, with the device with the lowest control oil pressure determining the position of the control oil servomotors and consequently the load carried by the main turbine. The control circuit for the main turbine Load Limit motors that adjust the Load Limit valves were modified to include a runback circuit. Upon an initiation of a turbine runback signal, the Load Limit motors are energized and reduce main turbine load to a pre-determined set point.
This function was installed by a modification in 1989 so the secondary plant could automatically meet system demand upon loss of a MBFP. This system aids operations by reducing the chance of a RT following a loss of a MBFP. A main turbine runback on loss of MBFP is initiated by the runback circuitry which uses a MBFP speed signal, main turbine steam inlet pressure representing power, and an Arm/Defeat switch to actuate a runback. At the time of the event the 22 MBFP was in service with no flow to the SGs, RPM less than 3300, and the 21 MBFP at approximately 4000 RPM providing flow to the SGs with the Arm/Defeat switch in the Armed position and power at approximately 35%. The failed bistable gave the runback system a signal that the turbine was greater than 76.5 percent (steam inlet pressure bistable PC-412B-1). With a MBFP below the runback speed limit and the Arm/Defeat switch Armed, the circuit coincidence for runback was completed and a runback signal generated. With reactor power level at approximately 35 percent, the runback caused the main turbine control valves to close resulting in SG level perturbations.
The modification that implemented the runback feature resulted in the revision to the following procedures; 1) POP-1.3, "Plant Startup from Zero to 45% Power,." and 2) System Operating Procedure SOP-21-1, "Main Feedwater System." Procedure POP 1.3 was revised to place the Arm/Defeat switch in "Arm" when the second MBFP was greater than 3300 RPM.
Procedure SOP-21.1 was also revised to state if one MBFP is secured with reactor power greater than 76.5 percent, then a turbine runback occurs unless defeated on Panel FAF. There is also a step in the SOP for the main turbine which allows the Control Room Supervisor (CRS) to put the turbine runback selector switch in Arm or Defeat at his discretion after main turbine control oil testing. Plant startup procedure POP-1.3 contained a step to Arm the runback feature when both MBFPs were above 3300 RPM. The procedures did not provide any information when it came to placing the switch in the Defeat position during normal load reduction or following a RT. Due to this omission, during plant startups when operators got to the step that directed them to place the Arm/Defeat switch to the Arm position in POP-1.3, it was normally in that position already. The procedures and training on those procedures conditioned the operators to having the switch normally in the Arm position. During the refueling outage that started on March 23, 2008, after a RT, main turbine control oil testing required application of a Protective Tagging Order (PTO) to the turbine runback switch with a clearance to place the switch in the Defeat position. Prior to applying the PTO, the switch was in the Arm position and after completion of the oil testing, the PTO was removed and the switch left in the defeat position (also the Check Off List position). On April 19, 2008, during plant startup, a Reactor operator (RO) noticed the Arm/Defeat switch was in the Defeat position and believed this was an incorrect position.
The RO notified the CRS and after the CRS reviewed procedures POP-1.3, SOP-21.1 and POP-2.1, "Operation at Greater than 45% Power," and considering prior experience, directed the RO to place the switch in the Arm position. In performing the main turbine control oil test, the switch was PTO'd and cleared to the Defeat position, otherwise the switch would have been in the Arm position and the CRS/RO would not have had any questions on repositioning the switch.
PC-412B-1 is a bistable {PC} manufactured by Action Instrument Company {A051}, model number AP1080. An extent of condition identified three other runback functions associated with the Load limits: Dropped Rod, Over Temperature Delta Temperature, and Over Power Delta Temperature. The settings associated with these runbacks have been adjusted to prevent runbacks from these features but the circuits remain susceptible to relay/bistable failure during plant shutdown or operation below 76.5% power.
Cause of Event
The direct cause of the reactor trip was manual actuation based on observation by control room operators of decreasing SG levels and loss of main generator load due to a turbine runback. The turbine runback was caused by a failure of main turbine steam inlet pressure bistable PC-412B-1 coincidence with a MBFP RPM less than 3300 and the turbine runback Arm/Defeat switch in Arm position. The causes identified for the event were weak procedural guidance for placement of the Arm/Defeat switch in the Defeat position, failure to follow the startup procedure (2-POP-1.3) due to human performance error, and failure to document status change per the intent of the procedure for conduct of operations (EN-OP-115). Plant operating procedure 2-POP-1.3, "Plant Startup from Zero to 45% Power," directed the operator to place the switch in "Arm" after the second MBFP was greater than 3300 RPM, which the operator missed due to human performance error. Procedure EN-OP-115 was not followed for log entry if a component is manipulated when there is no procedure guidance for performing the manipulation. The requirements to allow manipulation of the switch were considered met based on the belief there were no procedural guidelines. Operations procedures did not contain a step that placed the "Loss of Main Boiler Feed Pump Turbine Runback Arm/Defeat" switch in the Defeat position during plant shutdown or operation at power levels below 76.5%. This procedural omission would have resulted in a runback with the failed bistable during a down power.
Corrective Actions
The following corrective actions have been or will .be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence.
- The main turbine steam inlet bistables PC-412A-1 and PC-412B-1 were replaced.
- Procedure POP-1.3, "Plant Startup from Zero to 45% Power," was revised to provide guidance on arming and disarming the "Loss of MBFP Turbine Runback," circuitry.
- Procedure POP-2.1,"Operation at Greater than 45% Power," was revised to contain a step to place the Arm/Defeat switch in Arm at approximately 70 percent reactor power during power ascension, and in Defeat at approximately 70 percent reactor power on a power reduction.
- The operators involved with the event were coached/counseled on management's expectation for procedure use and adherence.
- Main turbine steam inlet pressure bistables PC-412A-1 and PC-412B-1 were sent to a vendor for an equipment failure evaluation (EFE). An evaluation of the EFE report will be performed and any necessary additional corrective actions included in the CAP. The evaluation of the EFE report is scheduled to be complete by July 31, 2008.
- A review will be performed of Abnormal Operating Procedures (AOP) that involve load reduction to ensure the MBFP runback Arm/Defeat switch is in the proper position to support load changes, and System Operating Procedures (SOPs) involving starting/securing MBFPs will be reviewed to ensure they address the Arm/Defeat switch appropriately. Review of the procedures is scheduled to be completed by June 30, 2008.
- Management's expectations will be re-inforced on the minimum actions expected when there are components not in the position needed with no procedural guidance on the correct position, and the Watch teams will be briefed on the established expectations. Completion of watch team briefings are scheduled for July 31, 2008
- Operations watch teams will be briefed on the event and lessons learned to include a discussion on the vulnerability established when placing the Arm/Defeat switch in the Arm position prematurely. Completion of the brief is scheduled for September 30, 2008.
- A TEAR will be prepared for Training to revise the operations training simulator setup for proper Arm/Defeat position and for inclusion of the root cause of this event in the Operations Training Program. The TEAR is scheduled for completion by July 31, 2008.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the reactor protection system (RPS) including reactor trip, and the AFWS. There was no safety system functional failure associated with this event which was an uncomplicated RT in which all primary systems functioned properly. This event meets the reporting criteria because the RPS (JC} was actuated by manual operator action in response to SG level changes and an unexpected turbine runback and the AFWS was actuated on low SG level.
NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001) FACILITY NAME (1) DOCKET (2) LER NUMBER 6 � PAGE (3) Indian Point Unit 2 05000-247 2008 - 03 00 OF
PAST SIMILAR EVENTS
A review of the past two years of Licensee Event Reports (LERs) was performed for events that involved a RT due to a turbine runback caused by an equipment failure and failures to follow procedures and/or weak procedural guidance. Three possible LERs were identified; LER-2006-004, which reported an automatic actuation of both motor driven auxiliary feed water pumps due to the trip of a MBFP caused by high vibrations. The apparent cause was weak procedural guidance in the main feedwater SOP which provided too narrow a critical speed. LER-2007-004 which reported a RT due to decreasing SG levels caused by the failure of the MBFP suction transmitter that actuated the MBFP low suction pressure runback controller. The pressure transmitter failure was due to capacitor age degradation. The root cause was inadequate verification of plant programs to address capacitor age degradation.
LER-2008-001 reported a RT due to decreasing SG levels caused by a loss of FW as a result of a MBFP speed control malfunction. The MBFP speed control malfunction was caused by Radio Frequency Interference from camera use near the speed control signal processer. A contributing cause was failure to follow the security procedure for camera use and request system engineering evaluation prior to camera use
Safety Significance
This event had no effect on the health and safety of the public.
There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents. Required primary safety systems performed as designed when the RT was initiated. There was no off normal status of any trains or portions of safety systems nor any unusual or abnormal status of other plant equipment. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure.
There were no significant potential safety consequences of this event under reasonable and credible alternative conditions. A RT and the reduction in SG level is a condition for which the plant is analyzed. This event was bounded by the analyzed event described in FSAR Section 14.1.8, Loss of External Electrical Load. The response of the plant is evaluated for a complete loss of steam load from full power without a direct RT and includes the acceptability of a loss of steam load without direct RT on turbine trip below 35 percent power. The analysis shows that the plant design is such that there would be no challenge to the integrity of the reactor coolant system or main steam system and no core safety limit would be violated. A low SG water level initiates actuation of the AFWS whose design has adequate capability to provide the minimum required flow assuming a single failure. For this event, rod control was in manual and all rods inserted upon initiation of a manual reactor trip. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.