05000220/LER-2012-001

LER-2012-001, Automatic Reactor Scram due to Electronic Pressure Regulator Failure

Nine Mile Point Unit 1
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
Initial Reporting
ENS 48110	10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation, 10 CFR 50.72(b)(3)(iv)(A), System Actuation
2202012001R01 - NRC Website

A. PRE-EVENT PLANT CONDITIONS:

Prior to this event, Nine Mile Point Unit 1 (NMP1) was operating and stable at 100 percent power with no inoperable systems affecting this event.

B. EVENT:

On July 17, 2012, at 1118, NMP1 experienced an automatic reactor scram. The reactor scrammed on high neutron flux caused by a rapid increase in reactor pressure. This rapid increase in pressure was caused by a sudden closure of the Turbine Control Valves (TCVs) due to failure of the Electronic Pressure Regulator (EPR). The Mechanical Pressure Regulator (MPR) did not take control as the backup pressure regulator in time to prevent a high neutron flux scram. A failure of the Linear Variable Differential Transformer (LVDT) providing servo position feedback (DT-1) to the EPR circuitry resulted in the EPR circuitry sending a close signal to the EPR servo. The TCVs closed, resulting in a pressure increase and high neutron flux scram.

Following the automatic reactor scram, the High Pressure Coolant Injection (HPCI) system automatically initiated on low Reactor Pressure Vessel (RPV) water level as designed. At 1119, RPV water level was restored above the HPCI low level actuation set point. At 1120 the HPCI initiation signal was reset. At 1125 the HPCI system was secured. After the reactor scram and turbine trip, the turbine bypass valves operated properly to control reactor pressure. All control rods fully inserted and all systems functioned as expected.

The pressure control unit for the NMP1 tandem compound reheat turbine is composed of two independent pressure regulators. One of the pressure regulators is a Hydraulic Mechanical Pressure Regulator (MPR) and the other is an Electrical Hydraulic Pressure Regulator (EPR). Normal system configuration is the EPR controlling pressure, and the MPR is set as a backup. The setpoints of both pressure regulators are adjusted to achieve reliable pressure regulator performance and to provide adequate margin to reduce the probability of a reactor scram due to pressure perturbation should the EPR fail. Should the EPR experience a downscale failure during plant operation, the output signal will begin to close the TCVs, and reactor pressure will increase. The MPR is designed to take over pressure control of the TCVs . An MPR/EPR servo indication difference is maintained within procedure limits to perform this function.

On February 26, 2012, the EPR had been removed from service due to erratic EPR servo indications.

An Operational Decision Making Issues (ODMI) checklist had been approved on April 10, 2012 for placing the EPR in service after replacing a demodulator card for DT-1. A management challenge was conducted on June 20, 2012 and the EPR was restored to service on June 26, 2012.

The monitoring plan per the approved ODMI established criteria on the MPR/EPR servo indications to maintain the difference tighter than the normal procedure limits. The servo indications were to be closely monitored to demonstrate reliability of the EPR after the repairs. Gaps between mechanical paddles on a torque tube allow either the EPR or MPR to be in control.

0 V i i 3 When the EPR was placed in service on June 26, 2012, the MPR paddle gap and the MPR/EPR servo indication difference were found outside of the ODMI monitoring plan limits. The MPR paddle gap was adjusted to within the ODMI monitoring plan limits; however, the indicated MPR/EPR servo indication difference was low outside of the ODMI monitoring plan limits. The initial data from when the EPR was placed in service and the MPR paddle gap adjusted was identified in a condition report. From June 26 to July 17, 2012 the MPR/EPR servo difference indications increased, back into the band, while visually maintaining the MPR paddle gap within the ODMI monitoring plan limits.

The initial data from when the EPR was placed in service and the increasing servo difference readings were logged in the monitoring plan.

When .DT-1 failed, and the TCVs closed, the MPR was not set close enough to take control from the EPR prior to the high neutron flux scram being received. Contributing to the MPR not taking control in time was the speed at which the TCVs were closed by the EPR. The EPR servomotor (hydraulic cylinder) stroke time must be limited to ensure satisfactory operation. This timing is set by adjusting the timing of the EPR MOOG Valve. The stroke time must be fast enough to provide good EPR response; however, the stroke time must be slow enough to prevent undesirable mechanical problems, such as pressure oscillations.

The combination of the EPR response timing set fast and the MPR paddle gap setting resulted in the MPR not being close enough to take control of reactor pressure when the EPR failed.

The HPCI system actuation signal on low RPV level is an expected occurrence following a reactor scram .due to water level shrinkage. The HPCI system is an operational.mode

• of the feedwater system and is not an Emergency Core Cooling System (ECCS).

There was no impact on Nine Mile Point Unit 2 (NMP2) from this event.

This event involved the automatic actuation of the Reactor Protection System (RPS), which resulted in a reactor scram, and the automatic initiation of the HPCI system due to reactor low water level.

The notification per 10 CFR 50.72(b)(2)(iv)(B) for RPS actuation and 10 CFR 50.72. (b)(3)(iv)(A) for HPCI initiation were completed on July 17, 2012 at 1323 (Event Number 48110).

EVENT:

There were no inoperable components or systems that contributed to this event.

D. DATES AND APPROXIMATE TIMES OF MAJOR OCCURRENCES

6/26/2012; 1800 - EPR placed in service. Monitoring plan implemented.

6/26 to 7/16/2012 - Monitoring of EPR and MPR parameters completed every shift. MPR paddle gap is verified within ODMI monitoring plan limits for all log readings after initial adjustment. MPR to EPR servo difference indications trend upward, indicating a widening MPR paddle gap.

1 I 7/17/2012; 1118 - NMP1 is at 100% power with the EPR operating normally controlling pressure, with the MPR as backup, when DT-1 fails. The failure of DT-1 causes an erroneous feedback input into the EPR circuitry. The EPR responds to the failure by sending a close signal to the hydraulics. The TCVs closed, resulting in a pressure increase followed by a neutron flux increase and corresponding Average Power Range Monitor (APRM) high flux scram signal from the RPS, initiating an automatic scram.

7/17/2012; 1118 - HPCI mode of operation initiates on low reactor water level.

7/17/2012; 1119 - Reactor water level is restored above the low water level set point.

7/17/2012; 1125 - HPCI mode of operation secured.

E. OTHER SYSTEMS OR SECONDARY FUNCTIONS AFFECTED:

None

F. METHOD OF DISCOVERY:

This event was discovered by the operators when the annunciators for high neutron flux and RPS initiation of the reactor scram alarmed in the control room.

G. MAJOR OPERATOR ACTION:

After the scram, the operators verified all rods fully inserted. No other actions were required to support shutting down the reactor.

H. SAFETY SYSTEM RESPONSES:

All safety systems responded per design. There was no loss of offsite power to the onsite emergency buses, the HPCI system initiated as designed, and the ECCS systems were available, but not called upon to support the safe shutdown of the reactor.

II. CAUSE OF THE EVENT:

The root cause of this event is the ODMI and associated monitoring plan had unclear roles and responsibilities assigned which resulted in less than adequate communication, oversight of the plan's implementation, and assessment of the monitoring plan's data. The contributing cause was inadequate documentation of the basis behind procedure requirements for the relationship between the EPR MOOG valve timing setting and given MPR paddle gap, which resulted in the backup MPR failing to take control in a timely manner when DT-1 failed. The DT-lfailure is attributed to age related degradation of the LVDT resulting in an erroneous feedback signal to the .EPR, which closed the TCVs 1 1.5%. The failure of DT-1 is considered a direct cause of the event and not the root or contributing cause.

Exceeding the ODMI monitoring plan action parameters was not properly communicated to the issue manager or station management.

The EPR and MPR are integral subsets of the pressure regulator for the NMP1 turbine mechanical hydraulic control (MHC) system. The MPR is designed to be a back up for the EPR at NMPI.

NMP2 turbine controls use an electrohydraulic control system; thus, NMP2 is not susceptible to the type of failure that occurred at NMP1.

This event was entered into the Nine Mile Point Nuclear Station (NMPNS) corrective action program (CR-2012-006792).

III. ANALYSIS OF THE EVENT:

This event is reportable in accordance with 10 CFR 50.73 (a)(2)(iv)(A), as an event or condition that resulted in manual or automatic actuation of any of the systems listed in paragraph 10 CFR 50.73 (a)(2)(iv)(B). Both the RPS and HPCI system (an operating mode of the feedwater system) were actuated during this event. Both systems are listed in 10 CFR 50.73 (a)(2)(iv)(B).

Except for the failure of the DT-1 servo position feedback to the EPR circuitry, there were no equipment failures associated with this event. All other plant systems performed per design. Plant parameters, other than the reactor water level, remained within normal values throughout the event.

There was no loss of offsite power to the onsite emergency buses, HPCI initiated as designed, and the ECCS systems were available, but not called upon to support the safe shutdown of the reactor.

Had a design basis accident occurred coincident with this event, plant systems would have responded per design to mitigate the accident. Based on the above considerations, the safety significance of this event is very low, and the event did not pose a threat to the health and safety of the public or plant personnel.

This event affects the NRC Regulatory Oversight Process (ROP) Index for Unplanned Scrams. Due to this scram, the Unplanned Scrams Index value will be 0.8 compared to the Green-to-White threshold value of greater than 3. This reduction will not result into entry into the "Increased Regulatory (White) Response Band.

IV. CORRECTIVE ACTIONS:

A. ACTION TAKEN TO RETURN AFFECTED SYSTEMS TO PRE-EVENT NORMAL STATUS:

1. The EPR was removed from service pending replacement of the EPR electronics and DT-1. The plant was returned to full power on July 21, 2012. Subsequently, during the NMP1 2013 refueling outage when the EPR electronics and DT-1 were replaced, the EPR was placed back in service.

B. ACTION TAKEN OR PLANNED TO PREVENT RECURRENCE:

1. The Operational Decision Making procedure has been revised to ensure that a review of open ODMI checklists is completed when operating conditions change and when the alarm or alert criteria in implementation plans are reached.

2. The Monitoring and Contingency Planning for Abnormal Conditions procedure has been revised to require action statements to notify the issue manager and Operations Manager of any parameters outside of alert ranges.

3. Replacement of the EPR electronics and DT-1 was completed in the 2013 NMPI refueling outage. This modification includes all LVDTs and servo position indicators associated with the EPR, as well as the other electronic components.

4. The maintenance procedure for calibrating EPR hydraulic components has been revised to update the speed setting to reduce the allowable tolerance that governs the EPR servomotor stroke time in the fast direction.

A. FAILED COMPONENTS:

The DT-1 servo position feedback to the EPR circuitry is the only component that failed during this event.

B. PREVIOUS LERs ON SIMILAR EVENTS:

Three previous LERs for NMPI were submitted due to similar EPR failures.

Pressure Coolant Injection Mode of Feedwater and Main Steam Isolation Valve Closure. The cause of this event was failure of the EPR servo-valve due to binding of internal components. The servo-valve was replaced.

Regulator. The cause of this event was loose, oxidized and intermittent electrical connections at one of the EPR's four LVDTs and electrical noise between adjacent field wiring. The terminal boards were cleaned and electrical connections tightened.

Malfunction. The cause of this event was a malfunction of either the steam line resonance compensator or the operational amplifier. Both components were replaced and the EPR calibrated.

C. THE ENERGY INDUSTRY IDENTIFICATION SYSTEM (EIIS) COMPONENT FUNCTION

THIS LER:

COMPONENT IEEE 803 IEEE 805

COMPONENT IDENTIFIER SYSTEM IDENTIFICATION

Linear Variable Differential Transformer N/A IT Electronic Pressure Regulator PC TG High Pressure Coolant Injection System Reactor Protection System Electrohydraulic Control System N/A BJ N/A JC N/A TG Turbine Control Valve PCV TG Mechanical Pressure Regulator PC TG D. SPECIAL COMMENTS: None )