05000261/LER-2010-009

LER-2010-009, Reactor Trip due to Motor Fault on the 'C' Reactor Coolant Pump, and Actuation of Auxiliary Feedwater Signal and Override of Feedwater Isolation Function due to Inadequate Post-trip Procedure Guidance

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(iv)(A), System Actuation
2612010009R00 - NRC Website

I. DESCRIPTION OF EVENT

At 0013 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> EDT on October 7, 2010, with H. B. Robinson Steam Electric Plant (HBRSEP), Unit No. 2, in Mode 1 at 100% power, an automatic trip occurred. An electrical fault on the motor for Reactor Coolant Pump (RCP) 'C' [AB:P] resulted in the Single Loop Low Flow reactor protection function and a subsequent reactor trip. Following the trip, the Auxiliary Feedwater (AFW) [BA] system automatically actuated due to low steam generator [AB:SG] water level and provided feedwater to the steam generators. Main Feedwater (MFW) Pump 'B' [SJ:P] tripped on low suction flow. The trip of Reactor Coolant Pump 'C' resulted in pressure in Steam Generator 'C' being below the pressure in the other two steam generators. This caused Auxiliary Feedwater flow predominantly to Steam Generator 'C.' Level continued to rise until Main Feed Pump 'A' tripped, as designed, due to a Feedwater Isolation Signal.

At approximately 0405 hours0.00469 days <br />0.113 hours <br />6.696429e-4 weeks <br />1.541025e-4 months <br /> EDT on October 7, 2010, the AFW system actuated due to a trip of MFW Pump 'A' while attempting to start the pump in accordance with procedure GP-004, "Post Trip Stabilization." The AFW system actuation signal caused motor-driven AFW Pump 'B' [BA:P] to start, motor driven AFW Pump `A' was already in operation due to the post-trip condition.

At approximately 1018 hours0.0118 days <br />0.283 hours <br />0.00168 weeks <br />3.87349e-4 months <br /> EDT on October 7, 2010, with the unit in Mode 3, feedwater isolation key switches were placed and maintained in the Override/Reset position in order to start MFW Pump 'A'.

Placing the key switches in the Override/Reset position resulted in the disabling of the feedwater isolation function, at the same time the feedwater regulating bypass valves were open, which is contrary to Technical Specification Section 3.3.2. This inoperability of the feedwater isolation function would have prevented the automatic feedwater isolation function described in Technical Specifications Section 3.3.2, which states that the primary function of the feedwater isolation signal is to stop excessive flow of feedwater into the steam generators. It also states that this function is necessary to mitigate the effects of overfeeding the steam generators which could result in overcooling of the primary system.

There is no Technical Specification allowed condition for both trains of the feedwater isolation function to be inoperable, therefore, Technical Specifications Limiting Condition for Operation (LCO) 3.0.3 was applicable from the time the feedwater isolation switches were placed in the Override/Reset position until the function was restored. At approximately 1315 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />5.003575e-4 months <br /> the operating crew recognized that actions taken at 1018 hours0.0118 days <br />0.283 hours <br />0.00168 weeks <br />3.87349e-4 months <br /> had unknowingly placed the plant in a condition prohibited by the Technical Specifications, which required entry into LCO 3.0.3. The crew took the appropriate action to close the MFW regulating bypass valves and exit LCO 3.0.3 at approximately 1329 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.056845e-4 months <br />. The LCO 3.0.3 completion time to be in Mode 4 within 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> was not exceeded.

II. CAUSE OF EVENT

The events have been investigated in accordance with the HBRSEP, Unit No. 2, Corrective Action Program (CAP) and are documented in Nuclear Condition Reports 425433, 425453, and 425643.

The investigation regarding the reactor trip concluded that the most likely cause of the failure of 'C' RCP stator is the synergistic effect of excessive vibration due to inadequate end winding bracing, coupled with normal aging, which caused the turn-to-turn insulation to fail. Failure of the inter-turn insulation ultimately propagated into a phase-to-phase fault which resulted in an instantaneous over- current trip on 'A' and 'C' phases.

The investigation regarding the AFW system actuation and inadvertent entry into LCO 3.0.3 concluded that General Procedure (GP)-004, "Post Trip Stabilization," was inadequate in that it did not provide appropriate guidance for resetting the FWI signal, and it did not contain verification methods for FWI reset or reference to the applicable Technical Specifications. The Feedwater Isolation (FWI) signal was not properly reset prior to attempting to restore MFW flow to the Steam Generators, which prevented the main feed pump from starting. The feedwater pump tripped instantaneously upon the start signal because a FWI signal was present in the pump circuitry.

III. SAFETY SIGNIFICANCE

According to the investigation regarding the reactor trip, the loss of 'C' RCP had a minor safety significance. It did result in a reactor trip, which challenges safety systems, however, the safety systems responded appropriately to this event. The decrease in reactor coolant flow rate and subsequent trip is classified in Chapter 15 of the UFSAR as a Condition II Event, which is a fault of moderate frequency, expected to occur on a frequency of once per year during plant operation.

UFSAR Section 15.3.1 evaluates a loss of all three RCPs and demonstrates no fuel will fail. The failure of a single pump is bounded by that evaluation.

According to the investigation regarding the AFW system actuation and override of the FWI function that resulted in the inadvertent entry into LCO 3.0.3, the inadvertent start of the AFW system did not pose a safety challenge because the system was already operating and did not cause a significant transient. The override of the FWI function placed the plant in a condition where the FWI accident mitigation function would not have occurred automatically. The analysis provided in the Updated Final Safety Analysis Report (UFSAR) Section 15.1.5, "Main Steam Line Break (MSLB) Events," states that main feed water isolation is assumed to occur within about 30 seconds of a safety injection signal.

The analysis assumes AFW flow continues at the maximum achievable rate. In the condition associated with the override of the FWI function on October 7, 2010, the Main Feedwater Regulating (MFR) Bypass valves were being used in manual control to maintain SG water levels. AFW was not in service at the time. In this configuration, the plant transient response to a MSLB is not analyzed, although it is highly likely that plant response would be within the results analyzed in UFSAR section 15.1.5, based on the continuation of MFW via the bypass potentially being equivalent or less severe than the continuation of AFW as analyzed in the UFSAR. The subsequent actuation of the AFW system and continuation of MFW via the MFR Bypass valves, if a MSLB event had occurred, would likely have not resulted in a significant change in the consequences of a MSLB event. This conclusion is based on the substantial conservatism included in the UFSAR Section 15.1.5 analysis. Specifically, the hot zero power cases assume the following:

The MFW pumps are assumed to take suction from Main Condenser Hotwell with makeup supplied from the condensate storage tank (CST) at a temperature of 33°F. The MFW flow is based on the operation of one of two Feedwater trains since this is the maximum number of trains that would be operable under Hot Zero Power conditions. Flow as a function of steam generator pressure is given in Figure 15.1.5-2. This flow is based on the combined head/flow characteristics of one condensate pump and one feedwater pump connected in series with a conservative treatment of the hydraulic characteristics in the feedwater train including the control valve.

This results in a conservatively high MFW flow rate. Like the Hot Full Power cases, the MFW will be isolated 30 seconds after receiving the isolation signal. AFW flow is assumed to start at break initiation and is held constant over the entire transient. The operator is assumed to terminate the AFW flow at 600 seconds. The AFW pumps are assumed to take suction from the CST at 33°F. All of the AFW flow is assumed to be delivered to the affected steam generator.

The analysis assumes that the feedwater valves are in automatic. This means that they would open further to maintain steam generator level when the main steam line break occurs. This results in additional water flowing to the steam generator and therefore additional steam generator steaming and RCS cooldown, exacerbating the accident. The analysis shows flow is greater than 1500 Ibm/s for approximately 40 seconds until feedwater isolation occurs. In this case, the bypass valves were partially opened and were in manual control. It is expected that less feedwater would be injected than assumed in the early phase of the accident (before feedwater isolation occurred) because the valves would stay in their pre-accident position rather than automatically opening as simulated in the analysis. Slightly more feedwater would be injected after the feedwater isolation until operators recognized the need to shut off the feedwater.

The analysis only takes credit for being 1000 or 1700 percent mille (pcm) shutdown (depending on the case analyzed) as described in UFSAR Section 15.1.5. With all control rods inserted and crediting excess shutdown margin built into the core design, the plant would have been expected to be over 3500 pcm shutdown. This additional shutdown margin would have further minimized accident consequences.

The substantial conservatism as described in this analysis supports the conclusion that the results of this analysis would not have been significantly affected by the override of the FWI function.

The Probabilistic Risk Assessment (PRA) includes an operator action to restore MFW in the event of a trip and AFW is lost or not available. Since placing the Feedwater Isolation Key Switches in the Override/Reset position was the action that was subsequently taken that allowed successful starting of the 'A' MFW Pump, there is a negligible risk increase as a result of the operators misunderstanding of the operation of the Feedwater Isolation Key Switches. The Feedwater isolation function is not modeled in the PRA because overcooling with a coincidence of inadequate shutdown margin is assumed to have a negligible impact to Core Damage Frequency (CDF). To determine the impact of the reactor trip due to the 'C' RCP trip, the reactor trip initiator in the PRA model was set to a value of 1.0, and the model was quantified. This resulted in a CDF of 1.6E-05. Since the base CDF is 1.2E-05, the resultant 4CDF is 4.0E-06. The overall plant increase in risk is approximately 2E-07 due to the increased trip frequency that this event contributes. Therefore, the safety significance of the event is considered low.

The conditions described in this Licensee Event Report are reportable in accordance with 10 CFR 50.73(a)(2)(iv)(A), any event or condition that resulted in manual or automatic actuation of any of the systems listed in 10 CFR 50.73(a)(2)(iv)(B), 10 CFR 50.73(a)(2)(v)(D), any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident, and 10 CFR 50.73(a)(2)(i)(B) as any operation or condition which was prohibited by the plant's Technical Specifications. Event Notification Reports 46313 and 46317 provided NRC notification of the required 4 and 8-hour reports on October 7, 2010.

IV. CORRECTIVE ACTIONS

Completed Corrective Actions:

• The failed motor from 'C' RCP was replaced with the motor that had been recently removed from 'A' RCP.

• GP-004, "Post Trip Stabilization," was revised to ensure the proper transition to OP-403, "Feed Water System." OP-403 was revised to ensure appropriate guidance for resetting the FWI signal, including verification methods and references to applicable Technical Specifications.

Planned Corrective Actions:

• Rewind the failed 'C' RCP motor using a design that provides for proper securing of all winding end turns to reduce vibration and improve long-term reliability.

• Rewind the motor currently installed on the 'C' RCP using a design that provides for proper securing of all winding end turns to reduce vibration and improve long-term reliability.

V. PREVIOUS SIMILAR EVENTS:

Licensee Event Reports (LERs) for HBRSEP, Unit No. 2, were reviewed from the past 10 years. The following similar events were found during this review:

Licensee Event Report 2010-002-00 This LER is similar in that it involves a reactor trip initiated by an electrical fault. The cause of this event was determined to be a cable fault in the 4KV electrical system. Based on the review of the causes and corrective actions for this event, it is concluded that the corrective actions would not have been expected to address the cause &the motor fault that occurred on October 7, 2010.

Licensee Event Report 2009-002-00 This LER describes a condition prohibited by TS. The cause was attributed to insufficient work instructions and the unique "energize to trip" aspect of the circuitry. Therefore, based on the review of the causes and corrective actions for this event, it is concluded that the corrective actions would not have been expected to address the cause associated with the override of the FWI circuitry that occurred on October 7, 2010.