05000286/LER-2014-001
| Docket Number | |
| Event date: | 1-06-2014 |
|---|---|
| Report date: | 3-04-2014 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2862014001R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On January 6, 2014, while at 100% steady state reactor power, the 33 Steam Generator (SG) {AB} steam flow (SF) Feedwater Flow (FF) mismatch and SG level control deviation alarms annuniciated at approximately 21:14 hours, followed immediately by a 32 Main Boiler Feedwater Pump (MBFP) vibration alarm. Operators observed the MBFPs operation and realized they were responding to a reduction in feedwater (FW) flow. Operators noticed the selected feedwater (FW) flow (FF) channel at zero and swapped to the alternate channel and noted both FF channels at zero. With the 33 SG level at approximately 10% and lowering, operators started actions to initiate a manual reactor trip (RT) {JC} when an automatic RT occurred at approximately 21:15 hours, on a SF/FF mismatch coincident with low SG level.
All control rods {AA} fully inserted and all required safety systems functioned properly with the exception of the intermediate range excore neutron flux detector N-35 which was undercompensated. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}. The Auxiliary Feedwater System {BA} automatically started as expected due to SG low level from shrink effect. The Emergency Diesel Generators {EK} did not start as offsite power remained available and stable. There was no radiation release. Investigations determined the decreasing SG levels was due to reduced main FW flow as a result of a closed 33 Feedwater Regulating Valve (FRV) (FCV-437) {FCV}. The closure of the 33 FRV-437 was due to no output from flow controller FC-437 {FC}. The RT event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR- IP3-2014-00054. A post trip evaluation was initiated on January 7, 2014.
The investigation focused on response of the SG Water Level Control (SGWLC) system {JB} for maintaining level and MBFP speed. The SGWLC system consists of four three element control configurations, one for each SG, to control the position of its associated FRV. The SGWLC system senses steam flow and FW flow mismatch and deviation from level set point and sends a signal to the FRV positioners to modulate the FRVs.
Main FW regulating valve (FRV-33) BFD-FCV-437 is an air operated flow control globe valve (AOV) manufactured by Copes Vulcan {C635}, Model D-100-160 actuator and valve. The valve fails closed on a loss of air and has a Bailey Model AV-1 positioner (ABB Brown Boveri) {B455}. The valve's safety function is to close to terminate FW flow to the SG. The valve will close by venting air pressure on receipt of a SG High Level signal, a Safety Injection signal or a RT signal. The elements that encompass the control loop are the Controller, current to pneumatic (I/P) Converter, Positioner, and Actuator/valve. The controller provides a signal to the I/P based on steam flow, FW flow, and SG level offset. The I/P converts the controller signal to a pressure which modulates the positioner to move the valve to the demanded position.
The investigation into the cause of the 33 FRV going closed started by verifying that the 33 FRV stroked in manual control from the auto-manual station FIC-437.
Subsequently, the 33 SG FW Flow controller {FC} FC-437 was verified as receiving the correct inputs. The investigation found that there was no output from FC-437, indicating that there was an internal failure of the controller. The 33 SG FW flow controller FC-437 {FC} is manufactured by NUS Corp {N430}.
An extent of condition investigation determined the FC-437 controller was a known single point of vulnerability that was past the expected 15 year life for its internal power supply. The other NUS controllers that are a single point of vulnerability at Unit 3 have all been replaced since 2009 with new NUS controllers that contain a new style power supply that has a 40 year life. The remaining NUS controllers that are single point of vulnerability are at Unit 2 and are scheduled for replacement in the 2014 refueling outage. The Unit 2 controllers do not have an elevated risk because they are still within their 15 year life. There remain other NUS modules at both Unit 2 and 3 that are beyond their 15 year life and are scheduled for replacement but are in low critical applications. Work Orders were prepared to replace the remaining SG FCs, LC's and auto-manual stations at unit 2 in the 2014 refueling outage.
The Cause of Event The direct cause of the RT was lowering SG levels and the inability to maintain SG levels. The decreasing 33 SG level was due to reduced FW flow from the closure of the 33 FRV-437 as a result of the failure of flow controller FC-437.
The apparent cause was station personnel exhibited tunnel vision to address the FW controller aging power supply vulnerability. Personnel focused on procuring an identical special three element controller as a replacement. The station knew there was a vulnerability and that the controller was past its expected 15 year life and was a single point vulnerability. However, addressing its replacement was allowed to be re-scheduled five times without applying lateral thinking to solve what was believed to be a parts problem as no special controllers were available. Personnel failed to apply lateral thinking and teamwork and question what other options were available besides procuring an identical controller. Subsequent to the RT, a solution of replacing the special controller with a generic controller and to provide a bypass of the set point dial via installation of internal jumpers was identified.
Corrective Actions
The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event.
- A project to improve procurement and ease replacement of NUS modules will be developed.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS) including RT and AFWS actuation.
This event meets the reporting criteria because an automatic RT was initiated at 21:15 hours, on January 6, 2014, and the AFWS actuated as a result of the RT. On January 6, 2014, a 4-hour non-emergency notification was made to the NRC at 21:55 hours, for an actuation of the reactor protection system (JC) while critical and included an 8-hour notification under 10CFR50.72(b)(3)(iv)(A) for a valid actuation of the AFW System (Event Log #49698). As all primary safety systems functioned properly there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v).
Past Similar Events
A review was performed of the past three years for Licensee Event Reports (LERs) reporting a RT as a result of main FW reduction. No LERs were identified that reported a RT due to a FW events.
Safety Significance
This event had no effect on the health and safety of the public.
There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents. Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure.
There were no significant potential safety consequences of this event. The Reactor Protection System (RPS) is designed to actuate a RT for any anticipated combination of plant conditions to include low SG level. The reduction in SG level and RT is a condition for which the plant is analyzed. A low water level in the SGs initiates actuation of the AFWS. Redundant safety SG level instrumentation was available for a low SG level actuation which automatically initiates a RT and AFWS start providing an alternate source of FW. The AFW System has adequate redundancy to provide the minimum required flow assuming a single failure. The analysis of a loss of normal FW (UFSAR Section 14.1.9) shows that following a loss of normal FW, the AFWS is capable of removing the stored and residual heat plus reactor coolant pump waste heat thereby preventing either over pressurization of the RCS or loss of water from the reactor. In addition, Operators for this event anticipated a possible low SG level and could have initiated a manual RT. The manual actuating devices are independent of the automatic trip circuitry and are not subject to failures which make the automatic circuitry inoperable. There are two manual trip buttons, one located on flight panel FCF and the other on safeguards supervisory panel SBF2.
Either one of these buttons will directly energize the trip coils of the reactor trip and bypass breakers in addition to de-energizing the undervoltage coils of the reactor trip and bypass breakers. For this event, rod control was in automatic and all rods inserted upon initiation of a RT. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.