05000250/LER-2003-008
| Turkey Point Unit 3 | |
| Event date: | |
|---|---|
| Report date: | |
| 2502003008R00 - NRC Website | |
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 05000250 YEAR I NUMBER
EVENT DESCRIPTION
On May 20, 2003 Florida Power and Light's Turkey Point Unit 3 was operating in Mode 1 at 100% power.
At 09:16 hours during the performance of the quarterly surveillance Rod Cluster Control Assembly Periodic exercise, Group 1 Shutdown Bank B did not move out with demand for withdrawal. An urgent failure alarm was received from rod control power cabinet 1BD while withdrawing Shutdown Bank B. Prior to receiving the alarm, Shutdown Bank A had been successfully exercised and Shutdown bank B was inserted twenty steps.
When Shutdown Bank B was being withdrawn, Group 1 of the Shutdown Bank B moved one step out to 211 steps when the urgent alarm was received. Group 2 of the Shutdown Bank B was at 214 steps when withdrawal was stopped. This condition reflects an inoperable shutdown bank with more than one full length control rod being inoperable.
At 9:16 hours, Operations entered the Off Normal Operating Procedure for Reactor Control System Malfunction, and Technical Specifications (TS), 3.1.3.1 Movable Control Assemblies Group Height, 3.1.3.2, Position Indication Systems, 3.1.3.5, Shutdown Rod Insertion Limit, and 3.0.3. At 10:00 hours Operations commenced load reduction to less than 90% power in accordance with TS 3.1.3.1 Action Statement b.2.
Technical Specification 3.1.3.5, Shutdown Rod Insertion Limit, requires that all shutdown rods shall be fully withdrawn in Mode 1. The Action for T.S. 3.1.3.5 is for a Maximum of one shutdown rod not fully withdrawn.
In this case more than one shutdown rod was inoperable and not fully withdrawn; therefore, TS 3.1.3.5 Limiting condition for operation (LCO) was not met. While action statement for 3.1.3.5 instructs the operator to apply Specification 3.1.3.1 or fully withdraw the rod, it explicitly states that this applies for a MAXIMUM of one shutdown rod not fully withdrawn. Therefore, there is no corresponding Action Statement if this requirement is not met. Without a specific Action Statement, TS Action Statement 3.0.3 was entered. At approximately 13:30 hours, Unit 3 commenced a load reduction to 30% power. At 15:43 hours, the reactor power was stable at 30% and a manual reactor trip was performed satisfying, TS 3.0.3. During shutdown, all the Unit 3 Rod Cluster Control Assemblies (RCCA's) performed their design basis function of inserting into the reactor core on demand. Accordingly, this event is reported herein under 10 CFR 50.73 (a) (2) (i) (A) for the completion of any nuclear plant shutdown required by the plant's Technical Specifications.
BACKGROUND
The rod Control System is designed to control the motion of the RCCA or control rods within the reactor core via both manual control and by automatic signals generated by the reactor coolant system instrumentation.
For transient response, the Rod Control System is designed to control the unit between 15 and 100% power for a 10% step decrease in load, a 5% per minute ramp unload, or with the aid of the steam dumps, a 50% load rejection. The Rod Control System is not credited for initiating or mitigating a design basis accident.
Shutdown of the reactor with the control rods is independent of the normal rod control functions since the reactor trip breakers completely remove power to the latch mechanisms, allowing the rods to fall into the core, regardless of any control signals.
The Rod Control System steps a control rod by sequentially energizing and de-energizing three electromechanical mechanisms located within the Control Rod Drive Mechanisms (CRDM). The CRDM contains a lift and two gripper assemblies which raise, lower or hold the attached Rod Control Assembly. The three control coils (Lift, Moveable, and Stationary) generate electromagnetic fields which operate the internal grippers and lift assemblies. The coils are energized sequentially in such a manner to move or hold the RCCA. Power to the coils is provided from one of the four rod control power cabinets. The Power cabinets FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 050002 50 I REVISION are controlled during normal operation by signals generated by the logic cabinet, which provides current orders and group selection (multiplexing data).
EVENT ANALYSIS
Instrumentation and Control (I&C) Maintenance immediately started an investigation to determine the cause of the urgent failure alarm.
The urgent failure alarm was received from rod control power cabinet 1BD. Power cabinet urgent alarm conditions are caused by logic errors, regulation failures, phase failures, multiplexing failures, loose or missing cards. The initial inspection of the 1BD power cabinet identified the DS1 alarm light on card K1. This alarm occurs when zero current is demanded for both the stationary and moving regulation circuits simultaneously. This generated the Rod Control Urgent Failure annunciator and stopped the rod motion to Shutdown Bank B, Group 1. This alarm is an indication of a logic error.
With Reactor trip breakers open, l&C performed troubleshooting of the logic cabinet which revealed that certain pins on cards were not as tight as expected. Specifically, the 1BD Slave Cycler cards associated with the failure were removed for a visual exam of the card's components and connector pins. The card edge connectors on the rod control circuitry cards utilize a flat split pin that engages another flat split pin, which has a 90-degree offset. Continuity of the connection is dependent upon the contact surface between pins at the split interface. These pins are very reliable but can relax over time, causing the split clearance to open thereby compromising a good electrical connection. Three cards were found with spread pins. For each spread pin found, a circuit analysis was performed to identify affected functions and failure symptoms. One of the questionable pins found was in the signal path that would have prevented outward rod motion on a loss of electrical continuity.
Logic card (A411) Movable Slave Cycler Decoder Pin 24 provides the UPSPX signal. This UPSPX (up command permissive) inhibits the slave Cycler decoder card until the counter signal has stabilized. This circuit path is only activated in the upward rod movement condition. An absence of UPSPX while outward rod motion is demanded would result in improper moving current orders provided by the logic cabinet to power cabinet 1BD. The improper moving gripper zero current order coincident with the expected stationary gripper zero current order during a rod step is detected as a logic error by the power cabinet.
Loss of the UPSPX signal was evaluated by both test and analysis. A spare slave cycler decoder chip was bench tested to identify the Logic State created by an open input. Based on the testing, an open input on pin 24 is seen as a high, the result being UPSPX would remain high, inhibiting the Movable Slave Cycler Decoder during rod withdrawal. With UPSPX always high, the demanded current to the 1BD movable coils would remain zero.
A circuit analysis shows that loss of the UPSPX signal to the 1BD Movable Slave Cycler Decoder would have prevented the current orders for the moving grippers from reaching the 1BD Power Cabinet during the requested rod withdrawal. The Movable Slave Cycler Decoder card is not monitored for failures in the Logic Cabinet; the rod control system relies on the Logic Error Detector in the power cabinets to detect this type of problem. The loss of the UPSPX input signal to the Movable FACILITY NAME (1) DOCKET NUMBER (2) r LER NUMBER (6) PAGE (3) Turkey Point Unit 3 050 002 50 I REVISION Slave Cycler Decoder card does not affect rod insertion via stepping or via opening the reactor trip breakers.
ROOT CAUSE
The immediate cause of the plant shutdown event is attributed to a Rod Control System malfunction, due to a loss of the logic UPSPX signal on the 1BD Movable Slave Cycler Decoder Card A411, split pin 24. This in turn caused an urgent failure for the Group 1 Shutdown Bank B Rod Clusters. This condition required entry into TS 3.1.3.5 and 3.0.3; whereupon, manual action was taken to shutdown the reactor in order to further troubleshoot the problem, with a trip of the reactor from 30% power.
Aging factors, such as cabinet vibrations, temperature transients and pin tension relaxation, can all be considered contributing factors affecting the pin connection integrity.
GENERIC IMPLICATIONS
The most probable cause for failure of the Rod Control System was a degraded connection between a circuit card and its card cage connector. The connector is an ELCO split pin design. ELCO split pin connectors are used in both Turkey Point Units 3 and 4 Rod Control systems, as well as Reactor Protection and Nuclear Instruments. Connector continuity problems are generic to electronic connectors. The specific generic consideration is limited to the Rod Control System and cabinets.
This particular type of ELCO connector is only used in the Rod Control System. ELCO connectors in Nuclear Instruments and Reactor Protection are of a slightly different design such that they are much less susceptible to this failure.
The subject connector is a highly reliable connector, which requires little maintenance. Accepted maintenance practice to restore pin tension is to squeeze the tangs back together. The card in question was last disturbed when the plant performed dynamic card testing, utilizing Westinghouse card testing service, several outages ago. Current maintenance practice is to perform dynamic cabinet testing to verify the overall performance of rod control power cabinets. This testing does not remove cards, but rather tests the performance of the system. This overall testing has been performed for the last few outages, but applies only to the power cabinets. The card in question is in the logic cabinet and was not part of that test. The condition of the connector was adequate to allow unit startup, shutdown, dynamic testing and quarterly rod movement surveillance for several operating cycles without failure. The failed condition of the connector degraded through normal aging (including thermal cycling, vibration and normal oxidation phenomena).
The services of Westinghouse will be secured to inspect and adjust all the card connectors in the Rod Control System during future refueling outages on both units. Generically, this condition could only affect the Rod Control System on either Unit 3 or Unit 4. Given the infrequent experience and the robustness of the connector design, this problem is not expected to occur prior to the planned connector maintenance inspection/ adjustment.
Monitoring of these connector signals (logic to power cabinet communication signals) by revision of the maintenance surveillance procedures will provide opportunities to detect and repair connector problems during refueling outages.
FACILITY NAME (1) DOCKET II NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 0 50 002 50 I REVISION
SAFETY SIGNIFICANCE
There were no equipment failures or operational parameter anomalies during the planned transient associated RCCA's performed their design basis function of inserting into the reactor core on demand. The health and safety of the public was not affected by this event.
CORRECTIVE ACTIONS
1. The spread pins were crimped together to improve continuity, and the Rod Control System was exercised in an effort to identify any other problems. The system performed without failure during all testing and the subsequent startup.
2. The rod control vendor will inspect and adjust all the card connectors in the Rod Control System during the Unit 3, Cycle 21 and Unit 4 Cycle 22 refueling outage.
3. Maintenance Surveillance Procedures will be revised to monitor the logic to power cabinet signals to detect potential degradation.
ADDITIONAL INFORMATION
None.
component function identifier (if appropriate)].