05000247/LER-2010-007
| Indian Point 2 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2472010007R00 - NRC Website | |
Note:�The Energy Industry Identification System. Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On September 3, 2010, at 10:58 hours during a scheduled plant shutdown for a forced outage, while at approximately 41% reactor power, an automatic reactor trip (RT) {JC} was initiated as a result of turbine trip (TT) due to a steam generator (SG) {AB} high water level {JB}. All control rods {AA} did not indicate fully inserted as the Individual Rod Position Indicator (IRPI) for rod H-8 indicated 38 steps withdrawn and its rod bottom light failed to light. Rod H-8 was verified to be fully inserted by alternate means. All primary systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}. The Auxiliary Feedwater Pumps (AFWP) {BA} automatically started as designed due to automatic trip of the Main Boiler Feedwater Pumps (MBFPs) (SJ} as a result of closure of the MBFP discharge valves from the SG high level trip. The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2010-05484. A post trip evaluation was initiated and authorization for restart completed on September 10, 2010.
Prior to the event the unit was operating with a high upper bearing temperature for the 21 reactor coolant pump (RCP) motor {AB}. At approximately 08:00 hours, operations commenced turbine load reduction for a scheduled plant shutdown to repair the 21 RCP motor. Power was reduced from 100% to approximately 41% between 08:00 to 10:30 hours.
During this time both MBFPs were in operation (AUTO) with stable steam flow, Feedwater (FW) flow and SG level. At approximately 10:54 hours, the 21 MBFP (lead pump) was removed from service (approximately 6000' gpm to 3300 gpm in approximately 60 seconds).
The 22 MBFP increased in speed to make up for the 21 MBFP being removed from service.
However, the loss of FW flow to the SGs was not made up by the 22 MBFP immediately.
There was a period of approximately two minutes following the securing of the 21 MBFP where total FW flow was reduced and resulted in a decrease in level in all four SGs.
The 22 MBFP speed increased to restore SG water level to the controller setting. FW flow remained below the initial stable flow for approximately one minute with SG level decreasing. The.22 MBFP continued to increase in speed and flow when SG level began to recover. Subsequently, SG level returned to the original level but MBFP speed and FW flow were elevated further increasing SG level. In response to increasing SG level operators placed the 24 Feed Regulation Valve (FRV) in manual control to reduce FW flow. Approximately 30 seconds after operators took manual control of the 24 FRV, the 22 and 23 FRV responded in AUTO and started reducing FW to their associated SGs. SG level was continuing to increase in SG 21, 22 and 23 but the level in SG 24 started to reduce. Operations initiated manual control of the 21 FRV and reduced FW flow to the 21 SG which resulted in increased FW flow to the other SGs (22, 23 and 24).
Subsequently the water level in the 23 SG reached the high level trip setpoint (73%) and a turbine trip on SG high level was initiated. A high SG level on two out of three level transmitters on any SG results in the automatic actuation of the following: 1) generator trip (86P and 86BU relays), 2) closure of the main and low flow FRVs, 3) closure of the MBFP discharge valves, and a turbine trip which results in a RT.
Closure of the MBFP discharge valves causes both MBFPs to trip. An automatic trip of either MBFP will initiate an automatic start of the AFWPs.
Following the unit trip, an investigation of the event was initiated. The investigation focused on response of the SG Water Level Control (SGLC) system {JB} for maintaining level and MBFP speed, and the greater than expected loss of FW flow associated with removing a MBFP from service at low power levels.
Cause of Event
The direct cause of the RT was a turbine generator trip due to a high 23 SG level.
The root cause was inadequate design control of the proportional band and reset tuning settings for critical plant controllers. There was less than optimum controller settings on the MBFP speed controller, FW controllers, and the SG level controllers for low power operation.
The following significant contributing causes (CC) were identified: CC1: Vague procedural guidance for securing the FW system at low power operations coupled with a human performance issue regarding the rate at which the speed was manually reduced on the 21 MBFP. Removing the 21 MBFP from service at a slower rate would have provided the 22 MBFP with a longer response time. The longer response time would allow the 22 MBFP more time to respond to the change in FW flow from the 21 MBFP and more closely match the change in FW flow. CC2: Untimely corrective action from previous root cause analysis (RCA). CR-IP3-2009-2710 included a RCA for a unit 3 automatic RT due to a high 32 SG level and engineering evaluated the optimum settings for SG level controllers (LC-417M, LC-427M, LC-437M and LC-447M) and FRV controllers (FC-417, FC-427, FC-437 and FC-447) for both units 2 & 3. The implementation of the recommended optimum settings have not been completed for either unit.
Corrective Actions
The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:
- I&C procedures that have been developed from I&C Preventive Maintenance (ICPM) documents have been reviewed to ensure that the instrument calibration requirements documented in the ICPM have been transferred into the applicable I&C procedures.
- A list of unit 2&3 critical controllers was generated, and the Equipment Data Base was updated with known existing settings.
- Procedure 2-SOP-21.1 (Main FW System) was revised to provide guidance to operators to decrease MBFP speed slowly over a ten minute period when securing a MBFP to minimize SG level perturbations.
- I&C procedures will be reviewed to identify changes to ensure controller calibrations maintain required settings.
- I&C procedures will be revised to incorporate testing of critical parameters.
- An Engineering Evaluation will be issued and the Equipment Data Base updated in the IPEC work control program (IAS Passport) with findings on controller settings information based on conclusions of extent of condition evaluation.
An engineering change (EC) will be prepared for both units 2 & 3 to revise SG control system controller mode settings to the engineering determined optimum mode setting for the FRV controllers (FC-417, FC-427, FC-437 and FC-447). The EC will include optimized mode settings for the SG level controllers (LC-417M, LC-427M, LC 437M and LC-447M).
- An inspection will be performed at units 2&3 of other critical controllers to collect data on existing proportional band and reset values.
- Operations procedures for plant shutdown at low power will be revised as necessary based on a review of the event.
- The MBFP speed controller FC-419 proportional band and reset timing settings have been reset to accepted engineering values.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS) including RT and AFWS actuation. This event meets the reporting criteria because an automatic RT was initiated at 10:58 hours, on September 3, 2010, and the AFWS actuated as a result of the SG high level condition. On September 3, 2010, at 13:11 hours, a 4-hour non-emergency notification was made to the NRC for an actuation of the reactor protection system {JC} while critical and included an 8-hour notification under 10CFR50.72(b)(3)(iv)(A) for a valid actuation of the AFW System (Event Log #46229). As all primary safety systems functioned properly there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v).
Past Similar Events
A review was performed of the past three years for Licensee Event Reports (LERs) reporting a RT from a TT due to a SG high level or FW flow malfunctions. No LERs were identified that reported high SG level initiated RTs. There were three LERs that reported RTs caused by malfunctions of MBFPs that resulted in decreasing SG levels.
LER-2008-001 reported a RT due to decreasing SG levels caused by decreasing MBFP speed as a result of radio frequency interference from camera use near the MBFP speed control processer. LER-2008-003 reported a RT due to decreasing SG levels caused by a turbine runback due to a failed MBFP runback circuit bistable with the control switch mispositioned to Armed. LER-2009-002 reported a RT due to decreasing SG levels caused by a loss of the 21 MBFP and failure of the main turbine to automatically runback. The 21 MBFP failure was due to a failed autostop oil line. These LERs did not have similar causes to this LER therefore their corrective actions would not have prevented this event.
Safety Significance
This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents. Required primary safety systems performed as designed when the RT was initiated. The Auxiliary Feedwater System (AFWS) {BA} automatically started as designed due to automatic trip of the MBFPs as a result of closure of the MBFP discharge valves from the SG high level condition.
There were no significant potential safety consequences of this event under reasonable and credible alternative conditions. The RPS is designed to actuate a RT for any anticipated combination of plant conditions including a direct RT on TT unless the reactor is below approximately 20% power (P-8). The analysis in UFSAR Section 14.1.8 concludes an immediate RT on TT is not required for reactor protection. A RT on TT is provided to anticipate probable plant transients and to avoid the resulting thermal transient. If the reactor is not tripped by a TT, the over temperature delta temperature (OTDT) or over power delta temperature (OPDT) trip would prevent safety limits from being exceeded. During this event the SG level control system functioned as designed and initiated a TT. A RT and the increase in SG level is a condition for which the plant is analyzed.
This event was bounded by the analyzed event described in FSAR Section 14.1.10, "Excessive Heat Removal Due to Feedwater System Malfunctions." Excessive FW additions is an analyzed event postulated to occur from a malfunction of the FW control system or an operator error which results in the opening of a FW control valve. The analysis assumes one FW valve opens fully resulting in the excessive FW flow to one SG. For the FW system malfunction at full power, the FW flow resulting from a fully open control valve is terminated by the SG high level signal that closes all FW control valves and trips the MBFFs. Trip of the MBFFs automatically actuates the AFWS. The SG high water level signal also produces a signal to trip the main turbine. A TT initiates a RT.
The analysis for all cases of the excessive FW addition initiated at full power conditions with and without automatic rod control, show that the minimum DNBR remains above the applicable safety analysis DNBR limit, the primary and secondary side maximum pressures are less than 110% of the design values, and all applicable Condition II acceptance criteria are met.
For this event, rod control was in automatic. All control rods did not indicate fully inserted as the Individual Rod Position Indicator (IRPI) for rod H-8 indicated 38 steps withdrawn and its rod bottom light failed to light. Rod H-8 was verified to be fully inserted by alternate means. Troubleshooting determined that two electrolytic capacitors of IRPI required replacement. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.